ConceptPrune: Concept Editing in Diffusion Models via Skilled Neuron Pruning
Authors: Ruchika Chavhan
Da Li
Timothy Hospedales
Venue: ICLR 2025 Poster (2025)
Keywords: diffusion models
concept editing
pruning
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: Training free Concept editing via neuron pruning

Abstract: While large-scale text-to-image diffusion models have demonstrated impressive image-generation capabilities, there are significant concerns about their potential misuse for generating unsafe content, violating copyright, and perpetuating societal biases. Recently, the text-to-image generation community has begun addressing these concerns by editing or unlearning undesired concepts from pre-trained models. However, these methods often involve data-intensive and inefficient fine-tuning or utilize various forms of token remapping, rendering them susceptible to adversarial jailbreaks. In this paper, we present a simple and effective training-free approach, ConceptPrune, wherein we first identify critical regions within pre-trained models responsible for generating undesirable concepts, thereby facilitating straightforward concept unlearning via weight pruning. Experiments across a range of concepts including artistic styles, nudity, and object erasure demonstrate that target concepts can be efficiently erased by pruning a tiny fraction, approximately 0.12% of total weights, enabling multi-concept erasure and robustness against various white-box and black-box adversarial attacks.

Published as a conference paper at ICLR 2025
CONCEPTPRUNE: CONCEPT EDITING IN DIFFUSION MODELS VIA SKILLED NEURON PRUNING
Ruchika Chavhan 1.2 Da Li?, Timothy Hospedales University of Edinburgh, SSasunng Al Center, Cambridge Correspondence: ruchika. chavhan@ed. ac. uk
ABSTRACT
While large-scale text-to- sot-tto-mmag diffusion models have demonstrated impressive image-generation capabilities, there are significant concerns about their potential misuse for generating unsafe content, violating copyright, and perpetuating societal biases. Recently, the text-to-image generation community has begun addressing these concerns by editing unlearning undesired concepts from pre-trained models. However, these methods often involve data-intensive and inefficient fine-tuning or utilize various forms of token remapping, rendering them susceptible to adversarial jailbreaks. In this paper, we present a simple and effective training-free approach, ConceptPrune, wherein we first identify critical regions within pre-trained models responsible for generating undesirable concepts, thereby facilitating straightforward concept unlearning via weight pruning. Experiments across a range of concepts including artistic styles, nudity, and object erasure demonstrate that target concepts can be efficiently erased by pruning a tiny fraction, approximately 12% of total weights, enabling multi-concept erasure and robustness against various white-box and black- bbx adversarial attacks. Code available https: //gi thub. com/ ruchikachavhann concept pprune
INTRODUCTION
In recent years, text-to-image generation has witnessed significant advances driven by the development and adoption of diffusion models (DMs) [Ho al., 2020: Rombach et al., 2021: Ruiz al., 2022; Saharia et al., 2022; Nichol et al., 2021; Zhang et al., 2023c; Luo et al., 2023; Podell et al., 2023] across industries and real-world scenarios. However, this swift advancement presents a substantial risk. Diffusion models can threaten artists' livelihoods through style replication [Sarah Andersen, 2023], generate convincing deepfakes and NSFW content [Review, 2023; Forensics, 2024], and perpetuate societal biases [Luccioni et al., 2023]. The risks associated with large-scale text-to-image models arise from billion-sized web-scraped datasets used in training, comprising public datasets like LAION [Schuhmann et al., 2022], COYO [Byeon et al., 2022], and CC12M [Changpinyo et al., 20, that often lack human-level quality assurance. A simplistic and naive solution to mitigate these risks involves fine-tuning the model on datasets without this undesired content; however, this approach can prove to be highly compute-expensive.
Several efforts addressing the risks of diffusion models have been made from the perspective of Concept Editing [Kumari et al., 2023; Gandikota et al., 2023a;b; Zhang et al., 2023a; Orgad et al., 2023] and Model Unlearning (MU) [Heng & Soh, 2023; Zhao et al., 2024; Liu et al., 2024; Wu et al., 2024; Fan et al., 2023], both aimed at eliminating undesired prompts, albeit with differing objectives. Concept editing methods seek to eliminate undesired prompts by aligning latent representations of the target concept with a concept to be retained, via methods such as maximizing similarity (Kumari et al., 2023; Gandikota et al., 2023a] and token remapping [Zhang et al., 2023a; Gandikota et al., 2023b]. Conversely. Model Unlearning formulates an objective that penalizes forgetting desired concepts while promoting the elimination of undesired ones, but this requires expensive computations and fine-tuning. Moreover, as most concept editing approaches rely some form of token blacklisting or resteering [Zhang et al., 2023a], adversarial attacks based on textual inversion [Zhang et al., 2023d; Pham et al., 2023; Yang al., 2023; Tsai et al., 2024] have demonstrated the ability to circumvent concept erasure methods [Gandikota et al., 2023a;b; Zhang et al., 2023a] that were previously believed to be robust with perfect success rate.

---

Published as a conference paper at ICLR 2025
In this paper, introduce ConceptPrune, entirely training-frre method for concept editing that, for the first time, tackles knowledge editing in diffusion models through the lens of pruning. Leveraging recently introduced pruning heuristics [Sun et al., 2024], we identify regions neurons in feed-forward layers of diffusion models that strongly activate in the presence of a concept, and denote them as skilled neurons. Subsequently, concept removal can be achieved by simply pruning or zeroing out these skilled regions. We demonstrate that ConceptPrune provides a rapid, efficient, and unified solution for erasing undesired concepts, including various artist styles, nudity, undesired objects, and gender biases. Notably, it maintains the outstanding sange-generation prowess of pre-traie rre-trained models while remaining resilient to adversarial attacks.
2 RELATED WORK
Concept Erasure in Diffusion Models: Concept erasure has gained significant attention and has rapidly emerged as pivotal area of research in diffusion models. Recent concept erasure methods can be broadly categorized into two main areas: Model Unlearning and Concept Editing.
Model Unlearning methods [Heng & Soh, 2023; Wu & Harandi, 2024; Fan et al., 2023; Zhang et al., 2024] typically require extensive training to forget a target concept while preserving unrelated ones. While these methods have shown remarkable efficacy in unlearning multiple concepts, they usually computationally expensive, especially for large-scale models.
Concept Editing [Gandikota et al., 2023a;b; Kumari et al., 2023; Zhang et al., 2023a; Huang et al., 2023; Lu et al., 2024; Lyu et al., 2023] focuses on modifications to specific parts of the model. These edits ensure that the denoised output for the target concept aligns with clean, desired concepts. The training costs associated with Concept Editing can be mitigated by strategies such as tuning only cross-attention weights [Gandikota al., 2023a; Kumari et al., 2023; Zhang et al., 2023a; Huang et al., 2023; Lu et al., 2024], solving closed-fore objectives to update attention parameters (Gandirrrta al., 2023b; Lu et al.. 2024; Orgad et al.. 2023], or parameter-effiiient adaptation like LORA [Hu et al., 2022] to edit the model [Lu et al., 2024; Lyu et al., 2023].
While the aforementioned methods are highly effective, deploying current saae--ofthee concept erasure techniques in real-worke scenarios poses significant challenges, particularly in online envi- ronments with computational constraints where harmful concepts can emerge dynamically. This is because these methods struggle to meet the following requirements for real-world applications: (1) training-free concept erasure, eliminating concepts without the need for backpropagation through the entire model, or (2) lightweight or fast concept erasure, allowing concepts to be removed quickly and efficiently with minimal compute.
Most concept-crasure methods rely extensive fine-tuning and are therefore not training-frees however some training- based approaches like UCE [Gandikota et al., 2023b], SPM [Lyu et al., 2023], MACE [Lyu et al., 2023], and FMN [Zhang et al., 2023a] are notably lightweight and suitable for the real-world setting. For instance, FMN erases concepts in 30 seconds and UCE in about 2 minutes, while the rapid fine-tuning of LoRA parameters makes SPM and MACE ideal for real-time online crasure. In Table 1, we present a comprehensive summary of related works, categorizing them based on whether they are training-free and lightweight for an online setting.
Our proposed solution, ConceptPrune, excels on both fronts by introducing a training-free, pruning- based approach that eliminates harmful concepts without updating any parameters. Instead, identifies and targets the neurons responsible for generating these concepts enabling efficient concept erasure with significantly reduced computational requirements.
Language model skilled neuron identification: Previous works [Wang et al., 2022: Suau et al., 2020; Durrani et al., 2023; Dalvi al., 2018; Durrani al., 2020; Antverg & Belinkov, 2022] present strong evidence that activation of specific neurons in feed-forward networks in transformers show high correlation with task labels, with perturbations to these neurons impacting task performance. Modular components within pre-trained transformers were identified by leveraging the inherent sparsity in neurons, as shown in [Zhang et al., 2022]. Further, [Zhang et al., 2023e] demonstrates that these modules are specialized in distinct functions. In this work, we aim to identify neurons accountable for generating undesired concepts in diffusion models - pursuit hitherto unexplored in this domain. Unlike language models, identifying neurons in diffusion models is complicated due
2

---

Published as a conference paper at ICLR 2025
Method
Training-free
Parameters Trained
Lightweight Erasure
CA [Kumari et al., 2023]
X
Full denoiser
SA [Heng & Soh, 2023]
x
Full denoiser
SH [Wu & Harandi, 2024]
x
Full denoiser
AdyUnicam IZhang ct al., 2024]
X
Full denoiser
SalUn [Fan al., 2023]
X
Full denoiser
ESD [Gandikota ct al., 2023a]
X
Cross Attention
Receler [Huang et al., 2023]
X
Cross Attention
FMN [Zhang al., 2023a]
X
Cross Attention
SPM [Lyu et al., 2023]
X
LORA
MACE [Lu ct al., 2024]
X
Cross Attention + LORA
UCE [Gandikota et al., 2023b]
Cross Attention
Ours (ConceptPrunee)
None
Table I: Summary of recent Concept Erasure baselines. ConceptPrune is a training- approach that enables rapid pruning of the model eliminate a new target concept without the need for extensive re-training.
the intricate aggregation of neurons across multiple denoising time steps and the model's sensitivity to the output of previous time steps.
Language model pruning: Network pruning [LeCun al., 1989; Liu al., 2019; Han al., 2015; Frankle & Carbin, 2019; Blalock et al., 2020] aims to reduce model size either by eliminating parameters and substructures from networks [Li et al., 2017; Frantar & Alistarh, 2023] or by masking parameters guided by a score function [Frantar & Alistarh, 2023; Frantar et al., 2023; Sun et al., 2024; Lee et al., 2019]. This study primarily focuses on the latter approach. Exploration of diffusion model pruning is limited, although one study [Fang et al., 2023] introduces structural pruning by accumulating gradient- based importance scores across chosen subset of denoising time steps. A study [Wei et al., 2024] explores safety-aligned LLMs that inhibit harmful prompts by leveraging pruning heuristics identify regions responsible for denying harmful responses. In contrast, we use pruning heuristics to locate critical weight regions responsible for unsafe behaviors in pre-trained models and permanently unlearn them through pruning.
PRELIMINARIES
(Latent) diffusion models: Diffusion models (DMs) [Ho al., 2020; Song et al., 2021] are essentially image denoisers that learn to reverse a forward Markov process in which noise is added into input images for multiple time steps E [0, 27. During training. given real image Xg. a noisy image X, at time t is obtained by /0tX0 + vT acc, where ~ (N00, T) and a, is gradually decaying parameter. Then, the denoiser learns to predict the noise added for obtaining xt, such that Xo can be reconstructed back by deducting predicted noise from
Latent diffusion models (LDMs) [Rombach et al., 2022b; Zhang et al., 2023b] are widely used as the first choice of DMs as they accelerate the above process by operating in latent space 2, of input Thus, a LDM consists of a latent embedding denoiser f.).. which is trained to predict the added noise by stochastically minimizing the objective C(z, p) E. [|le fo (ze, p, t)ll]. Given text prompt p. an encoder which extracts 2g from Xo and decoder which maps the denoised 2o to the pixel space. To synthesize image during inference based on text prompt p. one first samples noisy embedding žy which is iteratively denoised for T time steps until 2n for generating the final image is obtained. Normally, the encoder and decoder are obtained from frozen pre-trained autoencoder.
4 CONCEPTPRUNE: A TRAINING-FREE CONCEPT EDITING FRAMEWORK
Concept editing methods aim to eliminate the undesired concept from pretrained DM. Inspired by the observation that concepts can activate specific neurons in a neural network [Mahendran & Vedaldi, 2015; Wang et al., 2022], concept from a pre-trained DM by simply finding neurons specific to this concept, and pruning them? The answer is yes. We show that neurons in LDMs often specialise to specific concepts, and
Motivation:
ask the question: Can remove undesired
3

---

Published as a conference paper at ICLR 2025
that pruning these neurons can be used to permanently eliminate undesired concepts from image generation.
4.1 FEED FORWARD NETWORKS (FFNS) IN LATENT DIFFUSION MODELS
We focus on a pre-trained LDM, i.e. Stable Diffusson [Rombach et al., 2021], characterized by a UNet [Ronneberger et al., 2015] denoted as fa. The UNet architecture incorporates two ResNet blocks that sandwich two transformer blocks with self-attention between latent representations, cross- atteettntntio for the transfer of information from conditional inputs to latent representations, and Feed-forward Network (FFN) with GEGLU activation [Shazeer, 2020]. Prior research in concept editing, such as [Gandikota et al., 2023a] and [Zhang et al., 2023a], primarily examines cross-attention or self- attention visualizations to detect concept presence or generation. Diverging from this approach and drawing inspiration from NLP skill discovery [Suau al., 2020; Wang et al., 2022; Zhang et al., 2023e; Durrani et al., 2020; Dalvi et al., 2018], our focus lies on neurons within the Feed-forward networks.
We begin by denoting the input to the FFN layer at time step t for text prompt by (p) E R where N the number of latent tokens and corresponding output by (p) E RdxN, FFN Stable Diffusion consists of GEGLU activation [Shazeer, 2020] which operates shown in Equation 1.
(p) = = (W4.1 x(()))
2 (p) w h((p)
where, W E Rdd'dd w1. E Rdxdd are weight matrices the first and second linear layers, bias terms omitted for simplicity and (r.) is GEGLU activation [Hendrycks & Gimpel, 2023]. In our work, we regard [ the i-th row and [i, the element in i-th row and j-th column of matrix WTl.2
4.2 PRUNING STRATEGY: WANDA
We start with recapping the pruning method Wanda [Sun et al., 2024] for the large language models (LLMs), and its adaptation diffusion models. We denote the weights of linear layer by W e Rdout xdin and input X E R Bxd:., where B is the number of data points, i.c. the number of prompts in this paper. Unlike magnitude-based pruning. which considers the weights' magnitude alone, the concept behind the Wanda score is to estimate the combined effect of weights and the magnitude of features on neuron activations. Therefore, the importance of each weight is calculated as an element-wise product of its magnitude and the corresponding input feature-dimension-viie &a norm as shown in Equation?
S(W, X) W (1 doue -1x(112) E Iodou:
Here | to denote the absolute value operator, |X||| computes the & norm of each column of X and results a den dimensional vector, and O represents element-wise matrix multiplication. Specifically, Eq 2 broadcasts |X|| across different rows of W for computing the element- wise product in each row. For each row of W. represented by Wt, with corresponding Wanda score S(W, X).., the bottom-k%% weights with the lowest scores zeroed out [Sun et al., 2024]. This process effectively induces sparsity in each row of the weights W by eliminating the bottom-k-% of the weights, as a row is connected to a single activation in the output of a linear layer as a per-output basis [Sun et al., 2024]. Elements of the weight matrix W are often referred to as weight neurons, which are different from neurons corresponding to the output of layer. After pruning the least important weight neurons in layer, subsequent layers in the model receive updated input activations. Wanda does not require any costly weight update since it solely relies on a calibration set compute the feature norm matrix, which can be obtained with just single forward pass through the model. The following will discuss how we use Wanda to prune each row's kop-k% weight neurons for eliminating a concept.
4.3 IDENTIFYING SKILLED NEURONS IN LATENT DIFFUSION MODELS
Target and reference concept prompts: We first define two sets of calibration prompts P {pi: Pi.... Pir} and P = {pi PP... using M objects that can be generated by the model in target and reference concepts, respectively. Here, pf and p; represent prompts with the target and
4

---

Published as a conference paper at ICLR 2025
reference concepts, respectively. Objects represent common categories, including 'cat', 'dog'. etc. To eradicate the target concept, e.g., "Van Gogh" painting style, we formulate a pt as 'a <ob ject> in Van Gogh style' and p, 'a <ob cobject>'.
Importance score for FEN weights at time t: We begin by collecting the neuron activa- tions described in Eq 1, corresponding to the sets of target concept and reference prompts, and shape them into matrices denoted by H (P*) = [p]) (p5)) ....,,,(pp,, h((P)) and (P) = .(.p))"....,hh"
(bi())) h²(p2)² ..... (PM) )²) such that HP) E R (MMN))xd'' Note that this process
only requires one forward pass for per prompt.
After collecting both sets of neuron activations, we calculate the importance score for the linear weight W4. in Eq for both target and reference prompts using the methodology described in 4.2
and Eq 2 as
w/ o (1d [H((P))))) S(w42 H(())) |/ (1 [H(())))
((W"2HH(PP
(3)
For ease of notation, we denote S(WL.2 ((W(2.H((P')) and S(W1.2 HP))) (P())) and (P)) re- spectively in the subsequent sections. Following this, we identify a skilled neuron by comparing its importance score for the target concept prompt with that for the reference prompt.
HPP)))
Isolating geeerat-gnnr neurons at time t: Similar to Wanda [Sun et al., 2024], we adopt a per-outpur comparison group, which considers the importance scores among weights in each row of the weight matrix, rather than the matrix as a whole. Specifically, for given sparsity level 1%, we define the top-k% important weight neurons for generating the target concept in row-i denoted by W7.2 [i, as
(i = {1 if (i(P") E top-k% of (((P") to otherwise,
(4)
where I((P") forms a binary mask matrix for the concept prompt set P* As P contains additional undesired target concepts compared with P, (P()) thus consists of the set of important neurons that responsible for generating both the target and reference concepts. Our next step involves filtering and disentangling these neurons to isolate them to generate the target concept and the reference separately. Continuing with comparison on the Wanda score matrices for both target and reference prompts sets, we now define skilled neurons.
Definition 4.1 For linear layer characterized by W the weight neuron W j. is defined as a skilled neuron at time step if [ii == and ((())) > (t())
In essence, if a weight neuron ranks within the top-k% Wanda scores among other neurons in a row of W for the target prompts P it contributes generating either the undesired target concept or the reference concept. However, if its Wanda score surpasses that of reference concept, it predominantly influences the target concept.
Subsequently, we form time-dependent binary mask M. over weight matrix W1.2 such that
[1 if weight neuron ( ji] is skilled4.1
Miiij]] {o otherwise,
(5)
where M; is subset of I as only neurons that highly activated by the target concept retained.
Removing aggregated skilled neurons over timesteps: While we previously described time- dependent skilled neurons, DiffPrune [Fang et al., 2023] demonstrates that weights can be pruned by aggregating a pruning metric over a selected subset of timesteps based on relative importance scores. However, in our study, discovered that simply aggregating the binary mask the first i denoising iterations suffices to eliminate a concept while preserving the underlying object. Consequently, we define pruned weight matrix W/ as
Wrl.2 W @ (-(WETTTLL...IMMM)))
where V and denote the logical OR and NOT operators. All the weights of the pre-trained diffusion model fe remain unchanged as only 1 substituted with pruned weights obtained from Equation 6. We then perform experiments with the pruned model evaluate the effectiveness of concept removal, i.e. subsequently, only use W for image sampling.
5

---

Published as a conference paper at ICLR 2025
5 EXPERIMENTS
5.1 EXPERIMENT DETAILS
We work with Stable Diffusion v1.5 (SD), which includes 16 FFN layers that serve as candidates for skilled neuron discovery and pruning. We begin by formulating the calibration sets P and P that are used to obtain the matrices H((P*) and (P) for calculating the score in Equation 3. The list of prompts and the exact structure of the sentences for different concepts is provided in Table in the Appendix.
The selection of FFN second layer for pruning was informed by an ablation study we conducted across various layers within the UNet, aimed at identifying the most effective pruning targets. Specifically, we analyzed the first layer of the FFNs, along with the query, key, and value weight matrices in all cross-attentie performance for pruning within these layers, as well as an analysis of neuron activation patterns. The results clearly indicate that the second layer of the FFNs proves to be more effective pruning candidate compared to other layers. This observation aligns with findings in the LLM literature. where these layers have also been identified as prime candidates for skill discovery and pruning [Zhang et al., 2023e; Suau et al., 2020; Wang et al., 2022]. Finally, to calculate neuron activations, we run the model for 50 denoising iterations and fix the seed before every forward pass to ensure the same initializations for both reference and target concept prompts.
Pruning candidates:
layers. In Appendix A.2, we present the concept erasure
Hyper-parameter selection: As discussed in Section 4.1, we select two key hyperparame- ters -ers-sparsity level 1:% and f-for aggregating skilled neurons across time steps. For each concept, we vary the sparsity parameter 1% between 0.5% and 5%, choosing the value that achieves the best trade-off between concept erasure and the retention of unrelated concepts. More details this hyperparameter selection process can be found Section A.3 of the appendix. The optimal sparsity levels k% and the corresponding i values for each concept outlined in Table 10 in the appendix. Interestingly, our experiments reveal that f = 10 is typically sufficient for erasing concepts while preserving objects, suggesting that low-level features such as style and objects are formed early in the denoising process, with fine-grained details being added later.
Baselines: We identify the following concept editing methods as closest competitors due to their lightweight approach: UCH[G (CG[Giiiioota et al., 2023b), Forget-Me-Not (FMN) [Zhang et al., 2023a], MACE [Lu et al., 2024], Receler [Huang et al., 2023], and SPM [Lyu et al., 2023]. These works are considered direct competitors as they share similar emphasis on computational efficiency. Additionally, we include training-intensive 2023], ESD [Gandikota et al., 2023a], Selective Amnesia (SA)[Heng & Soh, 2023], Scissorhands (SH)[Wu & Harandi, 2024], and AdvUnlearn [Zhang et al., 2024] in our comparison. However, we categorize these as indirect competitors, as their reliance extensive fine-tuning contrasts with ConceptPrune's 's training-frre free regime. We include a bascline only their method has been evaluated for that concept and is reproducible from their source code.
intensive methods such as Concept Ablation (CA) [Kumari et al.,
5.2 ERASING ARTISTIC STYLES
We consider five artists - Van Gogh, Claude Monet, Pablo Picasso, Leonardo Da Vinci, and Salvador Dali. To measure the efficacy of concept removal, created dataset of 50 prompts for each artist using ChatGPT, consisting of the names of their paintings followed by the name of the artist. To measure the efficacy of concept removal, we report two metrics: the CLIP Similarity, which measures the similarity between the generated image and the prompt, and a stricter CLIP score that penalizes a model when the similarity between the image generated by the concept-editing and the prompt is greater than the similarity between the image generated by the pre-trained SD and prompt. Lower values of CLIP Similarity and higher values of CLIP Score indicate better concept removal. We also evaluate the fidelity of general purpose image generation by measuring FID and CLIP Similarity on the COCO30k dataset. From the quantitative results presented in Table 2, we demonstrate that our method outperforms other baselines in artist style removal while effectively retaining unrelated concepts, as indicated by the low FID score. In Figure I, we present some qualitative examples that demonstrate the strong erasing capabilities of ConceptPrune with high-quality realistic output
We reproduced CA remove nudity and object classes from ImageNette hut performance was very poor.

---

Published as a conference paper at ICLR 2025
Original
UCE
FMN
Ours
Table 2: Quantitative results Artist style removal, average over 5 artist styles. CLIP Similarity and CLIP Accuracy measure art style removal. FID and CLIP Similarity COCO30k measure fidelity for unrelated re- tained concepts. The full split of the results for different art styles is reported in the ap- pendix in Table 11. Our ConceptPrune can effectively erase artist styles without com- promising the model's performance on unre- lated concepts.
Monet
Van Gogh
Picasso
Da Vinci
Light weight
Artist crusurs
COCO
Similaity )
Sore 1
FDD
Similarit
Original SD
42.1
23.0
14.5
31.3
Dali
FSD
CA
32.4
54.1
65.2
49.2
17.5
15.9
31.3
50.7
SA
22.1
56.9
14.7
31.3
AdyUnleam
27.2
52.0
16.9
29.7
UCE
32.8
44.0
15.7
M.3
FMN
28.4
83.4
20.9
29.8
Figure 1: Qualitative results of artist erasure. Con- ceptPrune demonstrates stronger erasing while gen- erating high-quality, realistic-looking images.
MACE
28.2
31,0
26.9
16.9
images. More qualitative results are presented in Section A.4 in the appendix. While we demonstrate strong retention of unrelated concepts in COCO30k in Table 2, Section A.4 in the appendix further provides evidence that using ConceptPrune to erase an artist's 's style results in minimal degradation when generating other similar artist styles.
5.3 ERASING EXPLICIT CONTENT
We quantitatively evaluate our proposed method for moderating Sae-Saf--fo--Wie Work (NSFW) concepts like nudity by comparing against the concept-erasing baselines ESD, UCE, and FMN. In addition, we also compare with variants of Stable Diffusion, such as Safe Latent Diffusion (SLD) [Schramowski al., 2023] and Stable Diffusion 2.0 [Rombach et al., 2022a], which have been fine-tuned on filtered subset of LAION without explicit images. We use the Inappropriate Prompts Dataset (I2P) [Schramowski et al., 2023], which consists of 4703 prompts featuring various inappropriate concepts. Nudity detectors [Bedapudi, 2022] indicate that, out of these 4703 prompts, the pre-trained Stable Diffusion model generates nudity for 796 prompts. In Figure 2, we report the percentage reduction in the number of generated images with nudity compared to the pre-trained Stable Diffusion model. ConceptPrune generates nudity in merely 47 prompts within 4703 prompts in the I2P dataset, implying 94. 1% decrease compared to 88% in ESD and 85.6% in UCE, demonstrating significant improvement over other baselines in content moderation. We present more qualitative results on the I2P dataset in Figure 13 in the appendix.
5.4 ERASING OBJECTS
Single-object erasing:
We showcase the effectiveness of our method in removing objects from the learned concepts of diffusion models. We conducted experiments targeting ImageNette classes [Howard & Gugger, 2020], subset of ImageNet [Deng et al., 2009] comprising 10 classes. Similar to UCE and ESD, we generated 500 images per class and evaluated the top-1 classification accuracy using pre-trained ResNet-50 [He al., 2015]. Table 4 shows that ConceptPrune has superior erasure performance on average while effectively minimizing interference on non-targeted classes. More results of object erasure are provided in Figure 14 in the appendix.
We copied the numbers from their original papers based on SD 1.4 and therefore, we repeated our experi- ments with SD 1.4 for consistency.
7

---

Published as a conference paper at ICLR 2025
Table ConceptPrune demonstrates robustness adversarial attacks. Unlearning methods evaluated against three adversarial attacks. Black-box (Ring-A- Bell[Tssi et al., 2024], and MMA[Yang al., 2023]) performance quantified by percentage reduction nude samples compared to SD. White-box UnlearnDif- fAtk [Zhang et al., 2023d] performance measures the attack success rate (ASR).
WKF
Recder
202.0
7H0
9.0
Light- weight
Method
Ring-A-Bell
MMA
UnleamDiffAtt 1
2.8
25.5
82.4
SDv2
1.8
26.8
73.8
from
ESD
52.8
87.3
76.
94.3
Figure 2: Explicit Content Erasure. The per- centage reduction in nudity content from I2P prompts, compared to the original SD model ConceptPrune (SD1.5) decreases the number of explicit images by 94.1 %, outperforming competitors well SD2.0.
SH
86.1
94.3
22.3
AdyUnleamn
UCE
67.6
63.3
93.2
Receler
67.9
65.7
92.1
MACE
56.4
57.9
89.3
FMN
5.6
53.6
97.9
SPM
34.5
78.4
91.6
Ours
85.2
95.6
64.8
Table 4: Concept Erasure: Top-1 classification accuracy of erased and preserved class samples, using a pre-trained ResNet-50. Our ConceptPrune effectively erases objects from pre-trained models without impacting the accuracy for other object classes.
Classes
Accuracy of Erased Classes +
Accuracy of Preserved Classes 1
ESD
UCE
FMN
ConceptPrune
ESD
UCE
FMN
ConceptPrune
Church
54.2
8.4
2.0
6.0
80.2
77.5
57.8
82.8
English Springer
6.2
0.2
1.9
0.0
62.6
78.9
73.5
80.1
Golf ball
5.8
13.7
65.6
79.0
82.8
87.8
Gas Pump
8.6
0.0
7.9
0.0
66.5
80.7
79.0
83.0
Tench
9.6
0.0
5.7
0.0
66.6
79.3
78.4
85.0
Parachute
23.8
1.4
8.3
7.0
65.4
77.4
98.2
80.6
Cassette Player
0.6
0.0
1.0
1.0
64.5
90.3
68.7
94.3
Chain Saw
6.0
0.0
0.1
0.0
71.6
80.2
78.4
91.5
French Horn
0.4
3.0
0.0
3.0
77.0
80.1
78.3
88.2
Garbage Truck
10.4
14.8
0.1
0.0
51.5
78.7
74.9
85.8
Average
12.5
2.7
4.1
1.7
66.9
80.2
77.5
85,9
Multi-object erasing: addition to single-object crasing, we also evaluate ConceptPrune on removing multiple objects from the model simultaneously. Although pruning strategy generates a pruning mask for concepts individually, it provides a straightforward baseline for multi-object erasing by taking the union of skilled neurons across different concepts. We direct the reader to Appendix A.5 for more details. We compare our method with UCE and report the accuracy on erased classes along with FID and CLIP similarity COCO30k. Table shows that ConceptPrune demonstrates comparable erasing performance while excelling at retaining unrelated concepts.
5.5 ADVERSARIAL. DEFENSE ON CONCEPT ERASURE ATTACKS
White-box attacks: Recent research has recognized the limitations of the concept editing base- lines considered this paper, namely UCE, ESD, FMN, and CA. Model-based adversarial attacks like UnlearnDiffAAk [Zhang et al., 2023d] and Concept Inversion (CI) [Pham et al., 2023] have demonstrated that subtle perturbations to text prompts can circumvent the unlearning mechanisms, compelling concept-editing baselines to generate harmful images with undesired concepts again. Furthermore, these studies show a near- mear-perfect Attack Success Rate (ASR) for FMN and UCE which jeopardizes the safety and effectiveness of these baselines in real-world settings.
8

---

Published as a conference paper at ICLR 2025
Table 5: ConceptPrune is substantially more robust adversarial attacks aimed eliciting erased
concepts. (Top): Attack Success Ratio (ASR %, +) of UnlearnDiffAtk [Zhang et al., 2023d] adversarial prompts for Van Gogh's painting style and classes of the Imagenette dataset.
Artist Style
Object erasing
Light- weight
Vincent Van Gogh
Parachute ASR
Tench ASR
Garbage Truck
Church
Top-1 ASR
Top-3 ASR
ASR
ASR
ESD
32.0
76.0
54.0
36.0
24.0
60.0
77.0
SH
24.0
8.0
2.0
6.0
SalUn
74.0
14.0
42.0
62.0
AdvUnlcumn
2.0
24.6
14.0
4.0
8.0
6.0
UCE
94.0
100.0
43.0
22.0
38.0
68.0
FMN
56.0
90.0
100.0
100.0
98.0
96.0
SPM
96.0
90.0
82.0
94.0
ConceptPrune (Ours)
2.4
24.4
34.0
16.1
0.0
21.7
Table 6: Quantitative results for multi-object erasure. We report Accuracy on erased classes and FID on COCO30K, CLIP similarity COCO30k, and ASR of UnlearDDiffAtk. ConceptPrune is comparable to UCE at crasing multiple objects and outperforms UCE in retaining image generation capabilities along with being significantly robust to white-box adversaries.
COCO FID
CLIP score
Accuracy crased classes
ASR
UCE ConceptPrune
17.7
31.0
4%
22%
17.5
29.9
7%
6%
We evaluate ConceptPrune under these recently introduced white-box attacks UnlearnDiffAuk [Zhang et al., 2023d] and Concept Inversion (CI) [Pham al., 2023]. For UnlearnDiffAtk, evaluate for Van Gogh style, ImageNette objects, and nudity. We compare ConceptPrune with baselines UCE, ESD, and FMN across all concepts, and for nudity, we include comparisons with presumably safe models such as Safe Latent Diffusion (SLD) and SDv2. Following [Zhang et al., 2023d], we report the top-1 and top-3 ASR for Van Gogh style. which indicates whether the generated image is classified as the top-1 prediction or within the top-3 predictions for Van Gogh's 's painting style when evaluated by the post-generation image classifier. For object erasure and NSFW attacks, we report ASR based on pre-trained ResNet50 model and NudeNet detector respectively [Bedapudi, 2022]. Table (top) illustrates that for artist style and object erasure, ConceptPrune renders the UnlearnDiflAtk unsuccessful, achieving close to 0% ASR, in contrast to the perfect success rates seen for baselines like UCE and FMN. Table 3 shows that UCE, ESD, and FMN fail to defend against the NSFW attack, ConceptPrune demonstrates ASR of 64.8%, significantly lower than that the models that are trained for safety (SDv2 and SLD).
Following the evaluation protocol of Concept Inversion (CI), generated 500 images per class and evaluated the top-1 classification accuracy. Similar to CI, we also compare the performance of ConceptPrune against negative prompting (Neg-Prompt) [Yuanhao et al., 2024] and Safe Latent Diffusion (SLD-Med) [Schramowski et al., 2023]. In Table 13 in the Appendix, we observe that the accuracy of out of 4 erased classes is notably lower compared other baselines. This demonstrates that ConceptPrune offers significantly greater adversarial robustness against various white-box attack variants. We present more qualitative analysis in Figure 11 in the appendix.
To prevent the generation of NSFW imagery, SD models incorporate preventive measures such as prompt filters and post-synthesis safety checks by default. such as a web service, these defenses are considered impossible to override. Therefore, we also evaluate black-box robustness. Recent research MMA-Diffusion [Yang et al., 2023] released a set of 1000 adversarial prompts for SDv1.5 that circumvent safety filters on the text and image level. In addition, Ring-A A-Bell [Tsai et al., 2024] directly challenges our competitors ESD, UCE, and FMN and attacks their erasing strength with their set of adversarial prompts. Inspired by these works, we evaluate ConceptPrune along with competitors on adversarial prompts released by [Yang et al., 2023; Tsai et al., 2024] and report the percentage reduction in number of images for which nudity is
Black-box attacks:
black-box setting

---

Published as a conference paper at ICLR 2025
Removing skilee ncurons
Removing unsklleed neurons
Sxuds Mand
stll Gogh
A
1302
Uee
Abora the this cl
Laver
335 Up
uapt ChanSen
Cat bel
Countra hawe
Asarochueee
Figure 3: Left: ConceptPrune effectively disentangles skilled neurons responsible for specific concepts from general object- -bject-generating neurons. E.g., removing "Van Gogh" skilled neurons erases the "Van Gogh" style while removing unskilled neurons eliminates the object. Right: Skilled neurons are localized to very compact subspace, between 1 1% to 3% of FFN parameters.
generated as compared to pre-trained SD. Results in Table show that ConceptPrune offers stark increase in adversarial robustness with 95.6% decrease in the generation of nudity under MMA. This underscores its potential as a reliable and safe choice over our competitors. We present more qualitative analysis in Figure 11 in the appendix.
5.6 FURTHER ANALYSIS
Analysing the density of skilled neurons: We evaluate the density of skilled neurons, defined the percentage of non-zero elements in the pruning mask in Equation 5. Our analysis in Figure 3 (right) reveals that concept-generating neurons span less than 3% of the FFN weights matrix considered for pruning. This suggests that concept generation can be attributed to very tiny subspace, potentially constituting less than 12% of the total model parameters in diffusion models.
Are concept-generatting skilled neurons disentangled from we demonstrated that ConceptPrune exhibits strong concept erasure skills for a diverse range of concepts by discovering and pruning compact subspace of skilled neurons. Conversely, removing unskilled neurons, i.e neurons that satisfy the opposite of the second condition in Definition 4. 1.1 and follow (())) < (P) ji instead are hypothesised to distort the reference concept while retaining the target concept. Figure (left) offers qualitative examples that confirm our hypothesis, illustrating ability to isolate distinct set of neurons solely responsible for generating concepts, demonstrating their disentanglement from neurons responsible for generating general utilities. We present an interesting study on gender-specific neurons in diffusion models in Section A.7.
neurons? In Section
Can ConceptPrune generalize to other architectures? We demonstrate that ConceptPrune can be seamlessly applied to Stable Diffusion v2.0 and SD-XL. We erased the artist styles listed in Table and compared the results with UCE on SD-v2.0 and SD-XL. As shown in Table 14 in the appendix, ConceptPrune not only generalizes well different architectures but also delivers superior erasure performance across models.
6 CONCLUSIONS
This paper revisited the important challenge of concept editing in pre-trained diffusion models from the perspective of skilled neuron identification and pruning. We showed that concepts related to object categories, art styles, gender, and nudity can be identified and pruned leading to effective erasure while maintaining overall generation quality. Our ConceptPrune approach is fast, training-free, and permanent exhibiting strong robustness to adversarial attacks that break prior concept erasure methods. Without relying on token-rewriting, pruned models could be distributed without the risk of adversaries simply removing rewriting safeguards. We believe this result and capability will be valuable for the research and industrial communities to make socially responsible use diffusion models going forward.
10

---

Published as a conference paper at ICLR 2025
7 ACKNOWLEDGMENTS
This work was conducted while Ruchika Chavhan was PhD student at the University of Edinburgh with support from Samsung AI, Cambridge, UK.
REFERENCES
Omer Antverg and Yonatan Belinkov. On the pitfalls of analyzing individual neurons in language models. arXiv, 2022.
Praneeth Bedapudi. Nudenet: Neural nets for nudity detection and censoring. 2022.
Davis Blalock, Jose Javier Gonzalez Ortiz, Jonathan Frankle, and John Guttag. What is the state of neural network pruning? arXiv, 2020.
Minwoo Byeon, Beomhee Park, Haecheon Kim, Sungjun Lee, Woonhyuk Baek, and Saehoon Kim. Coyo-700m: Image-text pair dataset. 2022.
Soravit Changpinyo, Piyush Sharma, Nan Ding, and Radu Soricut. Conceptual 12M: Pushing web-scale image-text pre-training to recognize long-tail visual concepts. In CVPR, 2021.
Fahim Dalvi, Nadir Durrani, Hassan Sajjad, Yonatan Belinkov, Anthony Bau, and James Glass, What is one grain of sand in the desert? analyzing individual neurons in deep nlp models. arXiv, 2018.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Fei-Fei Li. Imagenet: large-scale hierarchical image database. pp. 248-255, 06 2009. doi: 2..100//VPRR.209552666
Nadir Durrani, Hassan Sajjad, Fahim Dalvi, and Yonatan Belinkov. Analyzing individual neurons in pre-trained language models. In Bonnie Webber, Trevor Cohn, Yulan He, and Yang Liu (eds.), Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pp. 4865-4880, Online, November 2020. Association for Computational Linguis- tics. doi: 10. 1...18655 emr.ppmmain 395.
URL https/////ccaaathaaaaggsoo wrwp://0ooog///0000/////
Nadir Durrani, Fahim Dalvi, and Hassan Sajjad. Discovering salient neurons in deep nlp models. Journal of Machine Learning Research, 24(362)11-40, 2023.
Gemini Team et al. Gemini: A family highly capable multimodal models. arXiv, 2024.
Chongyu Fan, Jiancheng Liu, Yihua Zhang, Eric Wong, Dennis Wei, and Sijia Liu. Salun: Em- powering machine unlearning via gradient-bast weight saliency in both image classification and generation. arXiv preprint arXiv:2310. 12508, 2023.
Gongfan Fang, Xinyin Ma, and Xinchao Wang. Structural pruning for diffusion models. arXiv, 2023.
Camera Forensics. The dark reality of stable diffusion. 2024.
Jonathan Frankle and Michael Carbin. The lottery ticket hypothesis: Finding sparse, trainable neural networks. arXiv,, 2019.
Elias Frantar and Dan Alistarh. Sparsegpt: Massive language models can be accurately pruned in one-shot. arXiv, 2023.
Elias Frantar, Saleh Ashkboos, Torsten Hoefler, and Dan Alistarh. Gptq: Accurate post-training quantization for generative pre-trained transformers. arXiv, 2023.
Rohit Gandikota, Joanna Materzyúska, Jaden Fiotto-Kaufman, and David Bau. Erasing concepts from diffusion models. In Proceedings of the 2023 IEEE International Conference on Computer Vision, 2023a.
Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzyńska, and David Bau. Unified concept editing in diffusion models. arXiv preprint arXiv:2308. /476/, 2023b.

---

Published as a conference paper at ICLR 2025
Kristian Georgiev, Joshua Vendrow, Hadi Salman, Sung Min Park, and Aleksander Madry. The journey, not the destination: How data guides diffusion models. Arxiv preprint arXiv:23/2.06205, 2023.
Song Han, Jeff Pool, John Tran, and William J. Dally, Learning both weights and connections for efficient neural networks. arXiv, 2015.
Kaiming He. Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. arXiv, 2015.
Dan Hendrycks and Kevin Gimpel. Gaussian error linear units (gelus). arXiv, 2023.
Alvin Heng and Harold Soh. Selective amnesia: A continual learning approach to forgetting in deep generative models. In Thirty-seventh Conference on Neural Information Processing Systems, 2023. URL wwwpt:tpp://o http://pppeeeeeeeeeeeeeeeeeeeeee /
n forum? ? i d= IJdds
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. arXiv preprint arxiv:2006. /239, 2020.
Jeremy Howard and Sylvain Gugger. Fastai: A layered api for deep learning. Information. 11(2):108, February 2020. ISSN 2078-2489. doi: 10.3390/infol 1020108. URL //x. doi org/ 10. 3390 fnloolnn11 1 020108.
Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. International
Conference on Learning Representations, 2022. URL https: https::/openzeeeee/eee /twp///eeeeeeeeeeeeee/eeeeeeo..e net /forum?rm id-nZevKeeFYf9.
Chi-Pin Huang, Kai-Po Chang, Chung-Tine Tsai, Yung- Hsuan Lai, Fu-En En Yang, and Yu-Chiang Frank Wang. Receler: Reliable concept erasing of text-to-image diffusion models via lightweight erasers. arXiv preprint arXiv:2311.17711 2023.
Nupur Kumari, Bingliang Zhang, Sheng- Yu Wang, Eli Shechtman, Richard Zhang, and Jun- Yan Zhu. Ablating concepts in text-to-imee eext-to-image diffusion models. In International Conference on Computer Vision (ICCV), 2023.
Yann LeCun, John Denker, and Sara Solla. Optimal brain damage. In D. Touretzky (ed.), Advances in Neural Information Processing Systems, volume 2. Morgan-Kaufman 1989. URL /ttppe///rroeeeeiingg neurips cc/paper_fiil hte__fiee/ppppppee /ttpe///paee/199/// htll://c8822aaa10000022222221222
Paper. pdff.
Namhoon Lee, Thalaiyasingam Ajanthan, and Philip H. S. Torr. Snip: Single-shot network pruning based connection sensitivity. arXiv,, 2019.
Hao Li, Asim Kadav, Igor Durdanovic, Hanan Samet, and Hans Peter Graf. Pruning filters for efficient convnets. arXiv, 2017.
Zhili Liu, Kai Chen, Yifan Zhang, Jianhua Han, Lanqing Hong, Hang Xu, Zhenguo Li, Dit- Yan Yeung, and James Kwok. Implicit concept removal of diffusion models. arXiv, 2024.
Zhuang Liu, Mingjie Sun, Tinghui Zhou, Gao Huang, and Trevor Darrell. Rethinking the value of network pruning. In International Conference on Learning Representations, 2019. URL https: ttttps://openrevieee net. forummid==o113333
Shilin Lu, Zilan Wang, Leyang Li, Yanzhu Liu, and Adams Wai-Kin Kong. Mace: Mass concept erasure in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.
2024.
Sasha Luccioni, Christopher Akiki, Margaret Mitchell, and Yacine Jernite. Stable bias: Evaluating societal representations in diffusion models. In Thirth- Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2023. URL https: openreview. net. net/forum? forum? FFqVXY03F017.
12

---

Published as a conference paper at ICLR 2025
Simian Luo, Yiqin Tan, Longbo Huang. Jian Li, and Hang Zhao. Latent consistency models: Synthesizing high-resolution images with few-step inference. arXiv, 2023.
Mengyao Lyu, Yuhong Yang, Haiwen Hong, Hui Chen, Xuan Jin, Yuan He, Hui Xue, Jungong Han, and Guiguang Ding. Oneedimmns adapter rule them all: Concepts, diffusion models and erasing applications, 2023.
Aravindh Mahendran and Andrea Vedaldi. Understanding deep image representations by inverting them. In Proceedings of the IEEE conference on computer vision and paltern recognition, pp. 5188-5196, 2015.
Alex Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen. Glide: Towards photorealistic image generation and editing with text-guided diffusion models. arXiv preprint arX1v:2112.10741, 2021.
Hadas Orgad, Bahjat Kawar, and Yonatan Belinkov. Editing implicit assumptions in text-to-image diffusion models. arXiv:2303.000 0300000843 2023.
Minh Pham, Kelly O. Marshall, and Chinmay Hegde. Circumventing concept erasure methods for text-to-image generative models. arXiv, 2023.
Minh Pham, Kelly O. Marshall, Niv Cohen, Govind Mittal, and Chinmay Hegde. Circumventing concept erasure methods for text-to-image generative models. In The Twelfth International Conference on Learning Representations, 2024. URL https: https////p/eeweeeeeeeeeeee wwtpr/wwwwweeeeeeeeeeeeeeeeeeeee fform?? id=ag3o2151Ht.
Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. arXiiv, 2023.
MIT Technology Review. Text-t--image ai models can be tricked into generating disturbing images. 2023.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. arXiv, 2021.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVÉ Confer- on Computer Vision and Pattern Recognition (CVPR), pp. 10684-10695, June 2022a.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition, pp. 10684-10695, 2022b.
Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedical image segmentation. arXiv, 2015.
Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. 2022.
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang. Emily Denton, Seyed Kamyar Seyed Ghasemipour, Raphael Gontijo-Lopes, Bureu Karagol Ayan, Tim Salimans, Jonathan Ho, David J. Fleet, and Mohammad Norouzi. Photorealistic text-to-image diffusion models with deep language understanding. In Alice H. Oh, Alekh Agarwal, Danielle Belgrave, and Kyunghyun Cho (eds.), Advances in Neural Information Processing Systems, 2022. URL https: cpenreview net forum
al Sarah Andersen. Case m0.3:2023cv00201. us district court for the northern district of california., 2023.
Patrick Schramowski, Manuel Brack, Bjöm Deiseroth, and Kristian Kersting, Safe latent diffusion: Mitigating inappropriate degeneration diffusion models. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition (CVPR), 2023.
13

---

Published as a conference paper at ICLR 2025
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade W Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, Patrick Schramowski, Srivatsa R Kundurthy, Katherine Crowson, Ludwig Schmidt, Robert Kaczmarezyk. and Jenia Jitsev. LAION-5b: An open large-scale dataset for training next generation image-text models. In Thirty-sixth Conference Neural Information Processing Systems Datasets and Benchmarks Track, 2022. URL httpp:://oppte hpwp///wwpeeeeeeeeeepeeeeeoeeeep net. forum iididdM1777 4
Noam Shazeer. Glu variants improve transformer. arXiv, 2020.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In Inter-
national Conference on Learning Representations, 2021. URL https: opwneeeeeeee.....eeeee www.eeewewweeee........ee......e net/ forum? sidddd-tt IgLarCLLP.
Xavier Suau, Luca Zappella, and Nicholas Apostoloft. Finding experts in transformer models. arXiv preprint arXiv:2005.07647 076447 2020.
Mingjie Sun, Zhuang Liu, Anna Bair, and J. Zico Kolter. simple and effective pruning approach for large language models. arXiv, 2024.
Yu-Lin Tsai, Chia-Yi Yi Hsu, Chulin Xie, Chih-Hsun Lin, Jia-You Chen, Bo Li, Pin-Yu Chen, Chia-Mu Yu, and Chun-Ying Huang. Ring-a-bell! how reliable are concept removal methods for diffusion models? arXiv, 2024.
Xiaozhi Wang, Kaiyue Wen, Zhengyan Zhang, Lei Hou, Zhiyuan Liu, and Juanzi Li. Finding skill neurons in pre-trained cunsformer-based language models. arXiv preprint arXiv:2211.073444 2022.
Boyi Wei, Kaixuan Huang, Yangsibo Huang, Tinghao Xie, Xiangyu Qi, Mengzhou Xia, Prateck Mittal, Mengdi Wang, and Peter Henderson. Assessing the brittleness of safety alignment via pruning and low-rank modifications. arXiv preprint 2Xi1:2202.001162. 2024.
Jing Wu and Mehrtash Harandi. Scissorhands: Scrub data influence via connection sensitivity in networks. arXiv preprint arXiv:2401.06187 2024.
Jing Wu, Trung Le, Munawar Hayat, and Mehrtash Harandi. Erasediff: Erasing data influence in diffusion models. 2024. URL https: http::::////peeeeeeeeee net wtt///ooummu////ee Lorr//rrrniieeeeeeeeeeee
Yijun Yang. Ruiyuan Gao, Xiaosen Wang, Nan Xu, and Qiang Xu. Mma-diffusion: Multimodal attack on diffusion models. arXiv preprint arXiv:2311.175/// 2023.
Ban Yuanhao, Wang Ruochen, Zhou Tianyi, Cheng Minhao, Gong Boqing, and Hsieh Cho-Jui. Understanding the impact negative prompts: When and how do they take effect? In arXiv preprint, 2024.
Eric Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. morget-me-not: Learning to forget in text-to-image diffusion models. arXiv preprint arXiv:2211.08332. 2023a.
Lvmin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control to text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference Computer Vision (ICCV), pp. 3836-3847, October 2023b.
Tianyi Zhang, Zheng Wang, Jing Huang, Mohiuddin Muhammad Tasnim, and Wei Shi. A sur- vey of diffusion based image generation models: Issues and their solutions. arXiv preprint arXiv:2308.11 13142, 2023c.
Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yihua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. To generate not? safety-driven unlearned diffusion models are still easy generate unsafe images... for now. arXiv preprint arXiv:2310.11866 2023d.
Yimeng Zhang, Xin Chen, Jinghan Jia, Yihua Zhang, Chongyu Fan, Jiancheng Liu, Mingyi Hong, Ke Ding, and Sijia Liu. Defensive unlearning with adversarial training for robust concept erasure in diffusion models. arXiv preprint arXiv:2405. / 2024.
14

---

Published as a conference paper at ICLR 2025
Zhengyan Zhang, Yankai Lin, Zhiyuan Liu, Peng Li, Maosong Sun, and Jie Zhou. Moefication: Transformer ceed-fowwrrd layers are mixtures experts. arXiv, 2022.
Zhengyan Zhang, Zhiyuan Zeng, Yankai Lin, Chaojun Xiao, Xiaozhi Wang, Xu Han, Zhiyuan Liu, Ruobing Xie, Maosong Sun, and Jie Zhou. Emergent modularity in pre-trained transformers. arXiv preprint arXiv:2305. 18390, 2023e.
Jieyu Zhao, Tianlu Wang, Mark Yatskar, Vicente Ordonez, and Kai-Wei Chang, Gender bias in coreference resolution: Evaluation and debiasing methods. arXiv, 2018.
Mengnan Zhao, Lihe Zhang. Tianhang Zheng, Yuqiu Kong, and Baocai Yin. Separable multi-concept erasure from diffusion models. arXiv, 2024.
A
APPENDIX
A.1 LIMITATIONS
While erasing specific objects, such as the "English Springer," we noticed that a few related dog breeds were also inadvertently removed. This suggests that although ConceptPrune effectively erases targeted objects, there remains some degree of interference with other fine- ane-grained classes. Although ConceptPrune can easily handle multi-concept editing by considering the union of skilled neurons, erasing a very large number of objects may result a degradation of overall image generation quality.
A.2 SELECTION OF PRUNING CANDIDATES
In this section, conduct ablation study various candidate layers within the UNet to determine the most effective pruning targets. Specifically, we examined the first layer the FFN (FFN-1), second layer of the FFN (FFN-2), the Key weight matrix in the Cross Attention layer (CA-Key), the Value weight matrix in the Cross Attention layer (CA-Value), and the second layer of the FFNs the text encoder (CLIP). CA-Key and CA-Value were considered because these weight matrices operate on text tokens, while the noised latent tokens are used as queries. We then apply ConceptPrune for pruning different parameters within these layers and report the concept erasure performance in Tables 7 and 8. Firstly, we visually observed that pruning CA-Key degrades image quality by distorting objects and textures. Therefore, we have decided with pruning CA-Key. From Tables 7 and 8, we empirically observed that FFN-2 is the best choice for pruning.
report the erasure performance associated
Additionally, we analyzed neuron activation patterns of different layers to understand which layers consist of neurons that are indicative the presence of a particular concept. For a given layer, we calculate the norm of activations for input neurons over reference and target prompts, averaging over denoising time steps. The top 1% neurons UNet are then identified and their distribution is plotted in 4 (b, c. d). We observed significant difference in distributions' means in the 2nd FFN layer, indicating distinct activations for reference and target prompts. This distinction is absent in other layers. From these results, it is evident that FFN-2 better and sensible pruning candidate than others.
Table 7: Accuracy of erased classes (4) and preserved classes (1) for object erasure across different pruning candidates. FFN-2 is a better pruning target.
Pruning candidate
FFN-2(in the paper)
FFN-1 Preserved
Ca-Value
CLIP Preserved
Erased
Preserved
Erased
Erased
Preserved
Erused
Parachute
6.9
72.8
21.0
62.2
32.0
69.2
38.0
47.8
English springer
0.0
46.2
90.0
32.8
89.2
1.0
42.3
French horn
1.9
74.5
17.0
74.8
31.4
79.2
18.0
72.4
Tench
0.0
47.0
87.1
73.4
A.3 DETAILS ON PROMPTS AND EYPER-PARAMETERS
Selecting optimal sparsity ratio To understand the effect of sparsity level (k%), we vary it from 0.5% 5% and plot erasure vs. retention performance. Erasure performance is measured by the
15

---

Published as a conference paper at ICLR 2025
Prundd micelt: Sains
Prstronnze meed
0.155
0.300
0.46
1.56
0.200
3.26
6.30
Erea Parforance
Itm
(h)
Auuron actvaltrr laps
Nearzn typer
Laye
Level
LEver?
16m 10m
(d)
Figure 4: (a): Erasing vs Retention Performance with varying sparsity thresholds. Concept Van Gogh. (b, c, d): Density of neuron activations for reference and target prompts in second layer of FFNs (pruned in paper), first layer of FFNs and Value layer in cross-attentions respectively. FFN-2 has the most distinct activation distribution.
E-
I- 10
Ew11
[-13
f=11
Figure 5: We present qualitative results by varying from to 15 and visualizing the images after concept erasure. Extending beyond 10 timesteps results in noticeable degradation of image quality.
CLIP similarity between the generated image and the input prompt, with lower values indicating better erasure. Retention evaluated using subset of COCO dataset prompts, measuring CLIP similarity between the generated image and the input prompt. From Figure 4(a), observed that a sparsity level = 2.5% or k = 2% offers a good balance of improved erasure with a minimal retention loss (main experiments used 2%).
Selecting optimal f As noted in Section 4, our work draws inspiration from the study in DifiPrune [Fang al., 2023], which utilizes Taylor expansion pruned timesteps estimate weight importance. Their findings reveal that earlier timesteps focus on local features like edges and colors, while later timesteps shift attention broader content, such objects and shapes. Similar to [Fang al.,
16

---

Published as a conference paper at ICLR 2025
Table 8: Erasure performance for artist style removal (first rows, CLIP similarity between the generated image and prompt (J)) and Nudity (last row, % nudity reduction (1)) across different pruning candidates. The sparsity level used for pruning is 2%. FFN-2 is better pruning candidate.
Praning candidate
Van Gogh
Monel
Leonardo Da Vinci
Pablo Picasso
Salvador Dali
Nudity
PFN-2 (in the paper) (2%)
29.2
23.6
26,5
25.3
29.8
94.1
FFN-1 (2%)
32.7
30.6
29.0
26.5
30.7
67.8
Ca-Value (2%)
32.7
30.3
28.6
27.7
27.7
46,2
CLIP (2%)
33,2
32.6
29.4
28.7
31.7
9.1
2023], [Georgiev et al., 2023] also shows that properties such as background color, object shape, etc generated in the earlier timesteps are carried forward to later in the denoising trajectory. Since our work primarily addresses local properties such as style, color, and object shape, we focus on removing concept-generatin neurons in the earlier timesteps, which contribute the most to salient properties in the image.
To determine E in Equation 5, we performed straightforward grid search over timesteps 1 to = 15, examining erased images to identify the timestep at which the concept was effectively removed from the majority of images. We present qualitative results in Figure 5 by varying & from to 15 and visualizing the images after concept erasure. The ablation study is conducted on two distinct concepts: the Van Gogh artist style and the object parachule. The prompts used for this analysis "A painting in the style of Van Gogh" for the artist's style and "A parachute in park" for the object. By varying f. we visualize the resulting images to evaluate the effectiveness of concept removal at different timesteps. Our findings demonstrate that focusing exclusively on neurons too early in the denoising trajectory fails to capture all the neurons responsible for generating the target concept. On the other hand, extending beyond 10 timesteps results in a noticeable degradation of image content and quality, striking a delicate balance between effective concept removal and preserving the overall integrity of the image. Therefore, ( 10 is an optimal point for concept erasure and good retention.
Table 9: Details on calibration set formulation for different concepts. We categorize all the concepts considered in the paper into global concepts like styles, nudity, object erasure, and gender change and provide the sentence structure of the concept prompts P and reference prompts P.
Concept
Cnncept (cconcept:))
Concege peoppt
Reference pronpt
Vio Mordi
joct?
style scosoapt>
Jobje Icer, chetr hag, ball,
Peots
Styles
Lecoardo De Vinci
dooc, rabelt, Joveet buwi, Aui, kums, bird vall. bonti.
Salvaãe Duii
Publo Picason
builiiing, chickes, dockk
Nuday
saked
a photo of naked speraon>
a photo of caaraen>
Spezzon"> C A lis of pecson selated words'
pardiii pi pamp god
A sonneegt 10 ceceres
A <6cene> [mot pantoo Anort
Obyect
springss. chan
player
nants puri, table
chait)
Object Frazzr:
church,
Rconcept> splace>
<lase>>
fotor, Inc. fineat carl
pork,
Gender charge
Male to Fessae
photo of ssale>
photo of <tnsale>
<male>> [mun, bus, person, pay
fukkrr ase Aashand, stoly)
Female
ploso of sterate>
photo of stale>
<Eenalo' [nomsnn aid fesuit dusplure nife sani)
A.4 ARTIST STYLE ERASURE
We present additional quantitative results and qualitative results for artist style removal in this section. Please see Figure 6, 7, 8, 9, and 10 and Table 11.
Cross-artist erasure: Ideally, erasing an artist's style should not impact the generation of other artist styles. However, concept erasure basclines like CA [Kumari et al., 2023] and UCE [Gandikota et al., 2023b] have reported slight degradation in generating paintings of other artists when similar style is removed. For instance, Kummar et al., 2023] demonstrates that removing 'Van Gogh' style results in the removal of the 'Claude Monet' style. To assess this quantitatively, we used CA, UCE, and ConceptPrune to erase the "Van Gogh' style and evaluated the performance over the remaining four artist styles in Table 11. We measure the CLIP similarity between the generated image and the input prompt, where a higher CLIP similarity indicates better preservation of the artist's 's style. Table 12 demonstrates that while ConceptPrune performs comparably to other baselines in preserving related artist styles, it outperforms them in maintaining the model's overall image generation capabilities (Table 2).
17

---

Published as a conference paper at ICLR 2025
Original
UCE
FMN
AC
ConceptPrune(Our)
Van Gogh
Van Gogh
Van Gogh
Figure 6: Qualitative results for erasing artist - Van Gogh. ConceptPrune(Oung generates high-quality
realistic-looking images without the artist's style.
Original
UCE
FMN
AC
ConceptPrune(Ours
Monet
Monet
Monet
Figure 7: Qualitative results for erasing artist - Monet. ConceptPrune(Ours) generates high-quality
realistic-looking images without the artist's style.
18

---

Published as a conference paper at ICLR 2025
Original
UCE
FMN
AC
ConceptPrune(Our)
T
Pablo Picasso
Pablo Picasso
Pablo Picasso
Figure 8: Qualitative results for erasing artist - Pablo Picasso. Concep(Prune(Ours) generates high-
quality realistic-looking images without the artist's style.
Original
UCE
FMN
AC
Conceptprune(Ours)
Leonarde Vinci
Leonardo
Leonardo Da
Figure 9: Qualitative results for erasing artist Leonardo da Vinci. ConceptPrune(Ours) generates
high-quality realistic-looking images without the artist's style.
19

---

Published as a conference paper at ICLR 2025
Table 10: Details on paper-parameters, sparsity level and for concepts considered our experiments.
Global Concept
Concept
Sparsity Level k%
i
Van Gogh
2.0
10
Monet
2.0
10
Art Styles
Leonardo Da Vinci
2.0
10
Salvador Dali
2.0
10
Pablo Picasso
2.0
10
Nudity
naked
1.0
9
Object Erasure
ImageNette classes
2.0
Male Female
5.0
20
Gender change
Female to Male
5.0
20
Table 11: Extension of Table for Artist Style removal in the main paper. We report CLIP Similarity and CLIP Accuracy for 5 artists.
Artist
Metric
ESD
UCE
FMN
CA
SA
MACE
Receler
AdvUnla
ConceptPrune
Van Gogh
CLIP Similarity
33.1
34.3
26.6
32,9
24.5
27.8
30.1
28.5
29.2
CLIP Accuracy (%)
39.0
36.0
96.0
58.0
96.0
82.5
79.8
69.0
84,0
CLJP Similarity
32.9
33.6
23.2
33.
25.6
24.5
23.9
25.0
23,6
Claude
Accuracy (%)
100
CLIP Similarity
33.5
32.9
33.0
31.3
30.9
28.9
29.3
26.1
25.3
Pablo Picasso
CLIP Accuracy (%)
58.0
56.0
58.0
78.0
72.0
75.6
78.4
82.7
100
CLIP Similarity
30.8
31.5
25.1
31.6
24.5
27.1
25.7
26.3
26.5
Leonardo Da Vinci
CLIP Accuracy (%)
66.0
64.0
62.0
56.0
87.6
88.
73.2
65.3
94.0
Similarity
29.8
Salvador Dali
CLIP Accuracy (%)
26.0
8.0
98.0
66.0
83.9
85.2
80.3
95.2
92.0
A.5 MULTI-OBJECT ERASING
We outline our approach to multi-object erasing, where we take the union of skilled neurons across all targeted objects and prune them collectively. Let the binary mask representing skilled neurons for concept in Equation 6 be M For erasing a set of multiple concepts C = {c1, C2, ... Cm. we take the union skilled neurons for each time step and concept Veec.Mt.' and formulate the pruned matrix W? as W? c (-(V (-VVET.TTL...TT Veec Mt where V and denote the logical OR and NOT operators.
A.6 CONCEPT INVERSION
We present the results of baselines considered in the paper in Table 13, which shows that ConceptPrune offers significantly greater adversarial robustness against CI.
A.7 ARE THERE SPECIFIC NEURONS RESPONSIBLE FOR GENERATING GENDER?
is widely acknowledged that image-generatte models harbor societal and gender biases [Luccioni et al., 2023]. A specific recurring pattern is models depicting males for professions such "CEO," and females for professions like "nurse." Concept editing methods like UCE [Gandikota et al., 2023b]
Model
Monet
Salvador Dali
Pablo Picasso
Da Vinci
Average
UCE
32.4
30.3
28.8
29.8
30.3
AC
31.6
28.9
26.7
28.4
28.9
ConceptPrune (Ours)
30.9
31.2
29.9
28.7
30.2
Table 12: We crase 'Van Gogh style from the model and report CLIP similarity (1) on surrounding artist styles. Higher CLIP similarities indicate better preservation of surrounding artist styles.
20

---

Published as a conference paper at ICLR 2025
Original
UCE
FMN
AC
Conceptirue((urs)
Salvador Dali
Salvador Daii
Salvador Dali
Figure 10: Qualitative results for erasing artist Salavdor Dali. ConceptPrune(Qury) generates
high-quality realistic-looking images without the artist's 's style.
ESD
FMN
UCE
CA
Neg-Promph
SLD-Med
ConceptPrune (Ours)
Tench
59.7
60.6
20.6
29.4
72.6
75.4
0.0
Church
87.4
0.0
82.2
72.6
78.4
72.0
11.0
Parachute
94.2
93.4
94.2
92.4
77.2
95.8
0.0
Garbage Truck
57.0
69.6
89.6
79.4
84.6
94.8
6.8
Average
74.5
55.9
71.7
68.5
78.2
84.5
4.5
Table 13: Top-1 classification accuracy (L) under CI [Pham et al., 2024] for Imagenette classes.
21

---

Published as a conference paper at ICLR 2025
UCE
ESD
Ours (No attsok))
FMN
SCORE
Ours (Attacc)
Ours
phd coop adious
nerves vircredtt
bacon workers
niclosund calestaa
hidden bubysitting
MMA
Ring-A-Bell
UnkeambiiffAk
Figure 11: Qualitative results of the failure cases of adversarial attacks demonstrating the robustness of ConceptPrune to both white-box and black-box -ox adversaries. Left: Top. middle, and bottom rows correspond to images generated by original SD, ConceptPrune without attack, and ConceptPrune under white-box AhlearnDiffAA attack respectively. Right: Qualitative results of black-box attacks MMA[ Yang et al., 2023] and Ring-A BongA-BBell [Tsai et al., 2024] along with quantitative results show that ConceptPrune maintains its content moderation abilities even under attacks.
Publo
Gugh
UCE
325
25.6
31.5
25.8 26,9 24.1
UCE
31.4
29.3
28.4
27.8
27.6
ConzepePamne
36.
213
268
25.7
Coneqeeouree
29.4
21
70.0
24.7
26.7
Table 14: CLIP similarity (L) for artist erasure experiments with SD-v2.0 (left) and SD-XL (right). Our ConceptPrune can effectively erase artist styles.
and MEMIT [Orgad et al., 2023] have addressed these issues by debiasing models ensure an equal representation of males and females across all professions. However, Gemini [et al, 2024] recently faced criticism for controversies stemming from over-debiasing models, resulting in the generation of factually or bistorically incorrect information'. This occurs because while debiasing may show a range of people for some cases, it fails to appropriately handle cases where such variation is not applicable.
To address this, we believe that gender choice in diffusion models should be precisely controllable, e.g., under the guidance of expert ethics committees. To explore, this illustrate controlled Gender Reversal We discover a set of "male" neurons via concept prompts P like {a man, a boy), reference prompts P like (a woman, a girl and vice-versa. Using ConceptPrune, can choose to remove male neurons, and generate female images, or vice-versa. This allows direct control of gender for any future prompt, via simple choice of mask. We evaluate our model across 35 professions in the Winobias dataset [Zhao et al., 2018] and report the success rate at which the gender of the individual classified by CLIP was reversed by ConceptPrune as compared pre-trained SD, Qualitative results for controlled gender reversal are presented in Figure 3 (Left). We observed that our model has success rate of 87 12% with more failure cases like erasing the person from the image arising from highly male or female-biased professions like Carpenter, Secretary, etc. In this paper, we not propose ConceptPrune as a practical solution for mitigating gender bias. Instead, primary objective is to emphasize the compelling discovery of distinct set of gender-specific neurons within the model.
*Our intention is not to defame. We only use this incident to motivate controlled gender reversal. 'ee exclude non-binary genders clear evaluation of gender reversal success rates.
22

---

Published as a conference paper at ICLR 2025
Original
Edited with ConcestPrune
ConceptPrune
Original
ConceptPrune
Original
Edited ConceptPrune
Original
Edited with ConceptPrune
Origina
Editd with ConceptPrune
Original
ConceptPrune
Original
Edited with ConceptPrune
Original
ConceptPrune
Original
Edited with ConcepePrune
Figure 13: Qualitative results for Nudity Erasure. We omit the prompts for safety. Images marked as "Original" correspond to images generated by pre- pre-trained Stable Diffusion. Sensitive parts have been blacked out by the authors for the purpose of publication. We observe that ConceptPrune erases nudity while preserving other details and quality of the image.
23

---

Published as a conference paper at ICLR 2025
Analyst (M -> Fi
Attendant (M
Goo
Baker (M
Clerk
Nurse (F
Teacher
Secretary (F M)
Receptionist (F M)
Figure 12: Qualitative visualizations of controlled Gender Reversal using ConceptPrune. M-+F and Fr- indicate the removal of "male" generating and "female" generating neurons respectively. In most cases ConceptPrune succeeds in reversing the gender of the individual.
OriginalDD
Original SD
Erasing English Springer
Erwwing Tench
Orginnal SD
Orignal SD
Erasing Garbage Truck
Erasing
Figure 14: Qualitative results for Object Erasure
24


Reviews:
[{"review_id": "hbyMjBBmG9", "reviewer": "Reviewer_B4VY", "summary": "The paper introduces ConceptPrune, a training-free method for concept editing in pre-trained diffusion models, specifically latent diffusion models like Stable Diffusion. The core idea is to identify and prune \"skilled neurons\" within the feed-forward networks (FFNs) of the model's UNet architecture that are responsible for generating undesirable concepts. By calculating importance scores based on neuron activations for target (undesired) and reference (desired) prompts, the method isolates neurons that predominantly influence the generation of unwanted content. Pruning these neurons effectively erases the target concepts while preserving the model's ability to generate unrelated content. The authors demonstrate the efficacy of ConceptPrune across various concepts, including artistic styles, nudity, object erasure, and gender biases, showing that pruning approximately 0.12% of the model's weights suffices. Additionally, the method exhibits robustness against both white-box and black-box adversarial attacks aimed at circumventing concept removal.", "questions": "See weaknesses.", "limitations": "", "rating": 6, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The paper introduces an application of neuron pruning techniques to concept editing in diffusion models. Specifically, ConceptPrune utilizes the identification and pruning of skilled neurons, providing an alternative approach to mitigating undesired content generation.\n\n2. The experimental results support the method's effectiveness in erasing various concepts while maintaining image generation quality. The authors compare ConceptPrune with several baselines, demonstrating its performance in concept removal and robustness against adversarial attacks.\n\n3. The manuscript is well-written and well-structured, offering clear explanations of the methodology and detailed descriptions of the experiments. Mathematical formulations are provided to illustrate the approach, and visual examples enhance comprehension.\n\n4. The work addresses significant ethical concerns related to the generation of unsafe or copyright-infringing content in diffusion models.", "weaknesses": "1. The method seems relatively straightforward and may be considered incremental in light of existing works [1,2] that also employ pruning techniques for unlearning in diffusion models. It would strengthen the contribution of the paper to clearly delineate the differences between the proposed approach and these related methods. Specifically, methods such as [1,3] have achieved state-of-the-art results in diffusion model unlearning tasks. Including these methods as baselines in the experimental comparisons would provide a more comprehensive evaluation and help illustrate the effectiveness of the proposed scheme.\n\n2. The experimental validation is conducted solely on Stable Diffusion, which may limit the generalizability of the proposed method. To address this potential limitation, it is recommended that the effectiveness of the approach be demonstrated on additional diffusion models, such as [4,5]. This would provide evidence that the method is not tightly coupled to a specific architecture and can be broadly applied to other models in the domain.\n\n3. The choice of focusing on the second layer of the feed-forward networks (FFN-2) for pruning appears to be based on empirical observations and may depend significantly on the architecture of Stable Diffusion. Is there theoretical justification or empirical evidence supporting this selection as the optimal pruning target? Providing analytical insights or additional experiments on different architectures would help ascertain whether this observation holds true universally or is specific to the model under consideration.\n\n4. The decision to aggregate skilled neurons over the last 10 timesteps for pruning seems somewhat arbitrary. Could the authors elaborate on the reasoning behind selecting this particular range of timesteps? It may be beneficial to reference insights from related literature [6,7] that discuss the importance of different timesteps in the denoising process. A more thorough explanation or an exploration of how varying the number of timesteps affects the results would enhance the understanding of this methodological choice.\n\n5. The evaluation of unlearning effectiveness in the context of artistic style erasure relies on CLIP-based similarity metrics. However, CLIP-based metrics consider redundant factors, not only the style but also the object content, arrangement, etc. It is potentially confounding the assessment of style erasure alone. This approach may not effectively isolate the stylistic elements from other irrelevant factors. It is recommended to employ a dedicated style classifier for evaluation (e.g., classifier in [8]) to more accurately measure the degree of style removal. This would provide a more reliable and focused assessment of the method's effectiveness in erasing artistic styles.\n\n> [1] Wu, Jing, and Mehrtash Harandi. \"Scissorhands: Scrub Data Influence via Connection Sensitivity in Networks.\" arXiv preprint arXiv:2401.06187 (2024).\n>\n> [2] Yang, Tianyun, Juan Cao, and Chang Xu. \"Pruning for Robust Concept Erasing in Diffusion Models.\" arXiv preprint arXiv:2405.16534 (2024).\n>\n> [3] Fan, Chongyu, et al. \"Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation.\" arXiv preprint arXiv:2310.12508 (2023).\n>\n> [4] Podell, Dustin, et al. \"Sdxl: Improving latent diffusion models for high-resolution image synthesis.\" arXiv preprint arXiv:2307.01952 (2023).\n>\n> [5] Saharia, Chitwan, et al. \"Photorealistic text-to-image diffusion models with deep language understanding.\" Advances in neural information processing systems 35 (2022): 36479-36494.\n>\n> [6] Balaji, Yogesh, et al. \"ediff-i: Text-to-image diffusion models with an ensemble of expert denoisers.\" arXiv preprint arXiv:2211.01324 (2022).\n>\n> [7] Georgiev, Kristian, et al. \"The journey, not the destination: How data guides diffusion models.\" arXiv preprint arXiv:2312.06205 (2023).\n>\n> [8] Zhang, Yihua, et al. \"Unlearncanvas: A stylized image dataset to benchmark machine unlearning for diffusion models.\" arXiv preprint arXiv:2402.11846 (2024).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "CmphIj6k1G", "reviewer": "Reviewer_PDbh", "summary": "To prevent the misuse of text-to-image diffusion models, this paper proposes a training-free approach using weight pruning for unlearning undesired concepts, such as artistic styles, nudity, and specific objects.", "questions": "In Table 5, the FID metric is missing, and the performance of the base model (SD) should be included for greater clarity.", "limitations": "", "rating": 8, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The experiments cover all diffusion model unlearning tasks, including artistic styles, nudity, and specific objects.\n2. Consider ASR against different attacks while simultaneously evaluating FID and CLIP score to assess model utility.\n3. The proposed method requires no additional training.", "weaknesses": "1. The chosen diffusion model baselines are weak and not state-of-the-art methods, so the comparison does not effectively demonstrate true superiority. To defend against adversarial prompt attacks, a stronger baseline, such as AdvUnlearn [1], should be considered.\n2. More visualization examples are needed, as the current version only includes visualizations for the style unlearning task.\n\n[1]  Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models, NeurIPS’24", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "K6kpW5SYsA", "reviewer": "Reviewer_YHCm", "summary": "The paper introduces ConceptPrune, a method for editing concepts in pre-trained diffusion models by pruning neurons associated with undesired concepts, like specific artistic styles, nudity, and biases. This approach identifies \"skilled neurons\" within diffusion models, such as Stable Diffusion, that activate in response to specific target concepts. By selectively pruning these neurons, the method effectively removes the unwanted concepts without the need for extensive fine-tuning, maintaining the model's overall performance on unrelated tasks. ConceptPrune demonstrates significant resistance to both black-box and white-box adversarial attacks, showing promise as a scalable and robust approach to safer model deployment.", "questions": "1. Could you please add discussions on the recent SOTA methods and relevant baselines as highlighted in the weaknesses section?\n\n2. How did you determine the optimal pruning ratio for skilled neurons? Please describe the considerations or criteria used in selecting a suitable pruning ratio.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "Strengths:\n- The investigation into how specific weights influence certain abilities in text-to-image (T2I) models is intriguing and provides valuable insights into the inner workings of these models.\n- The paper presents extensive experiments demonstrating the effectiveness of the proposed method across various editing targets, including nudity, artistic style, and specific objects.\n- Additionally, the paper is well-structured with a clear logical flow, making it easy to follow and understand.", "weaknesses": "- **Limited Comparison with Recent SOTA Methods**: The paper lacks sufficient discussion and comparison with recent state-of-the-art methods. For instance, [1] appears to be a strong baseline, demonstrating both high robustness in concept erasure and good utility preservation. While it’s acceptable if this paper does not outperform [1], it would be beneficial to include [1] as a baseline and discuss potential improvements for the current approach in light of their findings.\n\n- **Insufficient Discussion on Related Concept Pruning Work**: The paper lacks sufficient background on concept pruning and similar work. Several studies ([2, 3, 4]) have explored the relationship between weight importance and model abilities during unlearning and editing tasks. Incorporating these works would help situate this paper within the broader landscape and highlight how ConceptPrune builds on or differs from these existing approaches.\n\n[1] Zhang, Yimeng, et al. \"Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models.\" arXiv preprint arXiv:2405.15234 (2024).\n[2] Fan, Chongyu, et al. \"Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation.\" arXiv preprint arXiv:2310.12508 (2023).\n[3] Wu, Jing, and Mehrtash Harandi. \"Scissorhands: Scrub Data Influence via Connection Sensitivity in Networks.\" arXiv preprint arXiv:2401.06187 (2024).\n[4] Foster, Jack, Stefan Schoepf, and Alexandra Brintrup. \"Fast machine unlearning without retraining through selective synaptic dampening.\" Proceedings of the AAAI Conference on Artificial Intelligence. Vol. 38. No. 11. 2024.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "JCt2flogs4", "reviewer": "Reviewer_uDZE", "summary": "This paper addresses the risks of large-scale text-to-image diffusion models, including misuse for unsafe content, copyright violations, and bias perpetuation. Traditional methods for removing undesired concepts from these models often require intensive fine-tuning or token remapping, which remain vulnerable to adversarial jailbreaks. To tackle these issues, the authors propose ConceptPrune, a training-free approach that locates key regions in pre-trained models linked to unwanted concepts and applies weight pruning for efficient concept unlearning. Experiments show ConceptPrune effectively erases specific styles, nudity, and objects by pruning only 0.12% of weights, allowing multi-concept removal with resilience to adversarial attacks.", "questions": "1. Could the authors add more baselines by comparing their method with recently published machine unlearning methods in diffusion models?\n\n2. Could the authors include experiments on the robustness of machine unlearning? Specifically, experiments involving adversarial prompts or similar robustness tests would be valuable.", "limitations": "", "rating": 3, "confidence": 5, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. The paper is clearly written and well-structured. \n2. It offers an innovative approach to unlearning by employing model pruning techniques.", "weaknesses": "1. There is a lack of adequate baselines. The authors only compare their method to a few early baselines in machine unlearning within diffusion models. As far as I know, many more effective methods have emerged recently, but these were not included in the comparison.\n\n2. The robustness of the method is insufficiently studied. According to recent research, machine unlearning can be vulnerable to adversarial prompts. Without a robust evaluation, it remains unclear whether pruning-based unlearning is indeed resilient against such attacks.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)