Growth Inhibitors for Suppressing Inappropriate Image Concepts in Diffusion Models
Authors: Die Chen
Zhiwen Li
Mingyuan Fan
Cen Chen
Wenmeng Zhou
Yanhao Wang
Yaliang Li
Venue: ICLR 2025 Poster (2025)
Keywords: Stable Diffusion
Text-to-Image Generation
Concept Erasure
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Despite their remarkable image generation capabilities, text-to-image diffusion models inadvertently learn inappropriate concepts from vast and unfiltered training data, which leads to various ethical and business risks. Specifically, model-generated images may exhibit not safe for work (NSFW) content and style copyright infringements. The prompts that result in these problems often do not include explicit unsafe words; instead, they contain obscure and associative terms, which are referred to as *implicit unsafe prompts*. Existing approaches directly fine-tune models under textual guidance to alter the cognition of the diffusion model, thereby erasing inappropriate concepts. This not only requires concept-specific fine-tuning but may also incur catastrophic forgetting. To address these issues, we explore the representation of inappropriate concepts in the image space and guide them towards more suitable ones by injecting *growth inhibitors*, which are tailored based on the identified features related to inappropriate concepts during the diffusion process. Additionally, due to the varying degrees and scopes of inappropriate concepts, we train an adapter to infer the corresponding suppression scale during the injection process. Our method effectively captures the manifestation of subtle words at the image level, enabling direct and efficient erasure of target concepts without the need for fine-tuning. Through extensive experimentation, we demonstrate that our approach achieves superior erasure results with little effect on other normal concepts while preserving image quality and semantics.

Published as a conference paper at ICLR 2025
GROWTH INHIBITORS FOR SUPPRESSING INAPPROPRI- ATE IMAGE CONCEPTS IN DIFFUSION MODELS
Die Chen' Zhiwen Li
Mingyuan Fan'
Cen Chen
Wenmeng Zhou?
Yanhao Wang' Yaliang Li
Schooo of Data Science and Engineering, East China Normal University {dchen, ZhiwenIi, mingyuan_.my| @stu ecnu edu. en cenchen@dase. ecnu, wcnu.edu.ccm edu.cn wenmeng. www.::....@maaam wwwmalibaba inc. com
2 Alibaba Group
yhwangedase ecnu. ecnu, edu.cn
yaliang - com
ABSTRACT
Despite their remarkable image generation capabilities, text-to-image diffusion models inadvertently learn inappropriate concepts from vast and unfiltered train- ing data, which leads to various ethical and business risks. Specifically, model- generated images may exhibit not safe for work (NSFW) content and style copy- right infringements. The prompts that result in these problems often do not in- clude explicit unsafe words; instead, they contain obscure and associative terms, which are referred to as implicit unsafe prompts. Existing approaches directly fine- tune models under textual guidance alter the cognition of the diffusion model, thereby erasing inappropriate concepts. This not only requires concept-specific fine-tuning but may also incur catastrophic forgetting. To address these issues, we explore the representation of inappropriate concepts in the image space and guide them towards more suitable ones by injecting growth inhibitors, which tailored based on the identified features related to inappropriate concepts during the diffu- sion process. Additionally, due to the varying degrees and scopes of inappropriate concepts, we train an adapter to infer the corresponding suppression scale during the injection process. Our method effectively captures manifestation of subtle words at the image level, enabling direct and efficient erasure of target concepts without the need for fine-tuning. Through extensive experimentation, we demon- strate that approach achieves superior erasure results with little effect other concepts while preserving image quality and semantics.
WARNING:
This paper contains model outputs that may be offensive in nature.
INTRODUCTION
Recent years have witnessed the flourishing of text-to-image diffusion models (Sohl-Dickstein et al.) 2015 Nichol et al.) 2022), which demonstrate revolutionized generation capabilities and enable the creation of highly sophisticated and diverse images (Saharia et al.) 2022). Trained in vast and unfiltered data of varying quality (Rombach et al.) 2022;; Schuhmann et al. (022)), diffusion models
unintentionally learn inappropriate concepts, resulting in variety of risks (Somepalli et al., 2023
Liang et al. 2023 Tssi et al., 2024), such as the dissemination of not safe for work (NSFW) content and copyright infringement. For example, deepfakes have been used to tarnish the reputations of celebrities by replacing their faces with those in pornographic videos (Korshunov & Marcel 2018). Additionally, a style mimic can generate works that closely resemble the style of the victim artist with minimal time and computational resources, allowing them to profit without compensating the original artist (Shan et al., 2023] (Sompaali et al., (023). More seriously, these problems cannot be fully resolved by filtering out explicit unsafe words from text prompts because text prompts that contain only obscure and associative (unsafe) terms, which we refer to as implicit unsafe prompts, can still generate inappropriate images through the diffusion model. As an example, [Schramowski ct al. (2023) indicate that the prompt "Japan body" leads to the generation of nude images at more than 75%. As another example, simply using keywords from the titles of paintings in the prompts
"Corresponding author.

---

Published as a conference paper at ICLR 2025
Features each token in the prompt
v1.1.4
[SST]
lying
beach
[807g]
Erase nude
Ourrs)
50
Synonyms, adjectives
Same word, different forms
Step Sa
naked
sBc
bare
Nude
Nusity
different target crasure concepts
Figure I: Visualization of the features for each token in the prompt and the features extracted for the larget concept be erased. Although there is token in the implicit unsafe prompt that capture inappropriate features, our method introduces "nude" as a target concept to guide inappropriate features into appropriate ones during the diffusion process. We also present the features extracted from adjectives that are synonymous with "nude", as well as its capitalized form and noun variant.
can reproduce the corresponding artist's ' style, such as "Starry Night", which can generate images in the style of Vincent Gogh.
Although cleaning training data is straightforward method to avoid the generation of inappropriate content (Rombach al., 2022), it requires retraining the model from scratch and is thus laborious and resource-intensive. As such, fine-tuning the model has become more practical solution. One kind of method fine-tunes the model through textual conditional guidance (Poppi et al. 2024), redirecting inappropriate content to safer embedding regions by transforming pre- trained text embedding space. However, inappropriate features may reappear these methods due to implicit unsafe prompts. The other kind of method fine-tunes parameters associated with differ- ent modules (e.g., cross-attention and self-attention) the diffusion model steer the semanties of
2024 Li
images away from inappropriate concepts (Gandikota et al.) 2023 Lyu al.) 2024) or toward alter- native safe concepts (Kumari et al. 2023 Kim et al. 2023 Fan et al. (0024). These methods are also limited, they require performing fine-tuning multiple times for various concepts and easily lead to catastrophic forgetting. Furthermore, adjusting the output via a classifier (Rando et al. 2022) and providing textual guidance during inference (Schramowski et al. (023) can also be used for concept erasure without fine-tuning. But these methods are coarse and often fail to achieve precise erasure.
Our Contributions. In this paper, propose novel approach based Growth Inhibitors for Erasure (GIE), which can suppress inappropriate features in the image space without fine-tuning. During the diffusion process, we identify and extract features relevant to the target concept to be erased, re-weighting them to synthesize growth inhibitors. Then, we inject these features into the attention map group of the prompt that they can be precisely transformed into appropriate ones. Figure [ illustrates the process of erasing target concept "nude" from an implicit unsafe prompt and visualizes the features extracted for different target concepts relevant "nude".
Since the degrees and scopes of different target concept expressions vary significantly, using fixed suppression scale for all of them may result insufficient erasure of some images and excessive era- sure of others, leading to the generation of distorted and unclear images. Based on the intuition that there a relationship between the intermediate value of the cross-attention layer and the suppression scale, train an adapter to infer the suppression scale using only small number of samples. Once the adapter has established standard for the erasure effect through training, is even extensible to some concepts that have never been seen. In contrast to previous approaches, GIE innovatively control feature expression the image space instead of relying merely on textual guidance. This is beneficial for dealing with both explicit and implicit unsafe prompts. Additionally, it does not
2

---

Published as a conference paper at ICLR 2025
require adaptive fine-tuning for different target concepts and can perform erasure during inference, thereby facilitating its deployment and integration with different pre-trained diffusion models.
Finally, compare our GIE method with eight state-of-the-ar baselines through extensive perimentation. The results demonstrate that it not only achieves superior performance in crasing concepts related NSFW content, styles, and common objects but also shows little effect other concepts. It also preserves high image generation quality and good semantic aligmment of the dif- fusion models. Our code and data are publicly available at athhtps: /ttt:://gtthb/ htt.ggthhhu..ccc2222mmm100 com/CD22104/ Growth Inhibitors - for Errsure
RELATED WORK
There have been handful of studies on concept erasure in diffusion models. Existing approaches can be divided into three types: data cleaning, finetnunnng and intervention-based methods.
Data Cleaning-based Methods. A naive approach from training data and to retrain the model on the cleansed dataset from scratch (Nichol et al,) 2022 Rombach al., 2022). Stability Al (2022) leveraged an NSFW detector to label and filter inappropriate images in the LATON-5B dataset (Schuhmann et al., (022) when training the Stable Diffusion v2-1 model. Similarly, OpenAl (2023) assigns the original images with confidence scores and establishes a filtering threshold by manual verification for the DALL-E 3 model. However, these approaches only target sexual content. addition, they are highly resource-intensive and require substantial labor and computational power.
remove images containing specific concepts
Model Fine-Tuning Methods. The second type of method involves fine-tuning the model to erase specific concepts. Some methods of this type perform the fine-tuning process in the text embeddings for prompts. Poppi et al. (2024) proposed to fine-tune the CLIP text encoder in diffusion models with redirection losses to ignore inappropriate content in input sentences while understanding clean content. Li et al. (2024) additionally considers the duplicate semantic information in the [EOT] embeddings to erase explicit unsafe words in the prompt. However, some benign prompts that do not inherently exhibit intentions for inappropriate content are also likely to produce images with such content. This can be attributed the default objectification and sexualization of individuals in the diffusion model (OpenAl 2023).
There are also fine-tuning methods that directly operate on different modules of diffusion models. Gandikota et al. (2023) and Lyu et al. (2024) proposed the ESD and SPM methods that only use the required concept description and increase the distance between the noise specific to the target concept and the unconditional noise. the CA and SDD methods to gradually shift unsafe semantics to alternative concepts. Regarding the range of parameters, ESD, SDD, and CA fine-tune the full parameters in diffusion models, while SPM fine-tunes plugable modules tailored for specific concepts. Furthermore, machine unlearning (Bourtoule et al., 2021) is also integrated with fine-tuning for concept erasure. Fan et al. (2024) proposed SalUn that applied weight saliency to select key parameters and performed fine-tuning with substitution concepts. Wu et al. (024) formulated bi-level optimization problem erase information from the forgotten dataset while preserving its utility for the remaining data. (Heng] & Sohl (2023), on the other hand, takes a continual learning perspective, employing elastic weight consolidation to maximize the log-likelihood of designated proxy concepts and leveraging general dataset for generative replay. However, approaches based on fine-tuning require rerunning for each specific concept and may lead to catastrophic forgetting. For example, SalUn (Fan et al. (024) relies heavily on dataset diversity and is trained solely with common nude images, which may result in generated characters standing consistently with their arms at their sides.
Kumari et al. (2023) and Kim et al. (2023) proposed
Intervention-base Methods. The third type of method involves intervention during the generation process. Several methods (Baek et al., 2023, Gani et al.] 2024) Lian et al.) 2024 Zhong et al.) 2023) reduced the generation of unsafe content in text-lo-image models by refining the details of the input prompt. Other methods considered erasing inappropriate concepts in the image generation stage. [Schramowski et al. (2023) expanded the application of classifier- free guidance and steered the inference process. Moreover, classifiers like the safety checker (Rando et al. 2022 Comp Vis 2022) can detect inappropriate content, blocking its output or applying a blurring effect. These methods quite limited due to their coarse erasure of inappropriate content.
3

---

Published as a conference paper at ICLR 2025
3 BACKGROUND
Text-to-Image Diffusion Models. Diffusson models are a class generative models that create samples by gradually removing random noise from data (Sohl-Dickstein al., 2015 Ho et al. 2020). In these models, the forward diffusion process can be seen as a Markov chain, where an image æo, drawn from the natural data distribution q(x),, is progressively transformed into pure noise in steps by adding noise e. Specifically.
g(xx|xx-)) == (xx / 1, Be1), Vt (I.
(1)
where B, E (0, 1) controls the noise variance added at each step, and ar = Br represents the fraction of the original data preserved at step t. The cumulative effect of noise up the time step captured by a₂ I B.). We can define the noisy image at step as:
Lt
Vā,zo + vI u.E.
(2)
Starting from Gaussian noise JT (0, I), the reverse diffusion process iteratively removes noise using a trained noise predictor eø ( 1) to recover the original image Do E q(x). Based on Eq, the estimation of ze can be presented
3e vI
co( 04
It
+ ore,
(3)
where represents the noise scale.
In text-to-image diffusion models, classifier-free guidance (Ho Salimans, 2022) a widely used technique to steer the sampling process. After encoding the text prompt and an empty string Pe
into e and eg using pre-trained CLIP text encoder (Radford et al. 2021b Cherti et al. 2023), the noise prediction is as follows:
é ti cœ) c0 t; ca) + s- (e0( t;c) tx(xx,
where 8 represents the guidance scale adjust the alignment between the generated samples and the text prompt.
Cross-Attention and Attention Map Group. Diffusion models often leverage cross-attention to integrate text information with image features. Specifically, the image feature o(x;) is linearly transformed into a query matrix Q = (o(((z)). while the text embedding c is mapped into a key matrix K (c(c) and value matrix V εv (c) through separate linear transformations. When the query Q is multiplied with the key K, the attention map group can be obtained as:
QK?
(bol)(2)))xx(o)
M = Softmax
Softmax
RUX(HXB)NN
(5)
Vd
where d the projection dimension, the number of attention heads, H x B represents the spatial dimensions of the image, and N is the number of text tokens. A higher attention map value indicates stronger relevance between the image region and the corresponding token. The final output of the cross attention is M representing the weighted average of the values in V.
4 METHOD
In this section, we present the Growth Inhibitors for Erasure (GIE) method in detail. Generally, GIE innovatively delves into the representation of inappropriate concepts in the image space, offering solution that does not require tieettnnng. We provide an overview of GIE in Figure In Section we introduce an approach to extract growth inhibitors related to target concepts and inject them into the diffusion process of the original prompts. To balance concept erasure and image quality, we propose an adapter that infers the optimal suppression scale Section 4.2 Finally, we consider the simultaneous suppression of multiple concepts in Section 4.3
4.1 GROWTH INHIBITOR EXTRACTION AND INJECTION
Growth Inhibitor Extraction for Target Concepts. To capture the feature of a target concept that needs to be erased in the image space, integrate it into the diffusion process. As mentioned in
4

---

Published as a conference paper at ICLR 2025
features
Image Quaries
K: Tokans Keys (trom Prompt)
Attention maps
V. Tokens Values (trom Prompt)
Output
Crosa-Attertion in Diffusion
Overview
Attention group
GFT4
K from target concept
Visualize
Infer suppresion
TAX
Q from image features
X
Re-weight
Adaptar
Intermadiate vakae dlllcsstattrtion
K from the prompt
Growth inhibitors I
Ieject
Attention map group M
Attention maps Mepaior
Figure 2: Overview of the GIE model. The top figure illustrates that image features and text em- beddings are fused in cross-attention layer. The bottom figure describes the GIE framework. We introduce the target concept to be erased to calculate an attention map group M Then, we extract part of M* as the target feature for visualization. Our trained adapter can infer suppression scale re- re-weight these features, thereby synthesizing growth inhibitor I. By injecting / before the [EOT] of the prompt's attention map group M, the target concept can be erased.
Section 3] guided by the text embedding encoded from the text prompt p. the diffusion model gradually generates the image with cross-attention by calculating the attention map group M, which encapsulates the focused region information for each token in p. In GIE, additionally encode the target concept the text embedding e* and use as the new K to compute another attention map group M* along with the original Q. The above process can be formulated as follows:
(eelo)))))ll))) Vd
M = Softmax (aaimmmx(ollxi))xxrxx) (Lolo(z))(x(o>"")
M = Softmax
(6)
Vd
We extract attention map corresponding to the target token from M which concentrates the features that need to be suppressed in the target concept. For example, the text embedding of the concept "nude" is c* = {ciSOT) mude: GEOT) where [SOT] and [EOT] are used as structure markers indicate the beginning and end of the text sequence. Its attention map group obtained in cross- attention is M = {miso mude: Mi ). We only extract m as the target feature and discard misori and misory As observed in Figure [ the region corresponding to "nude" becomes more focused and precise during the diffusion process. Adjectives synonymous with "nude" and the capitalized and noun forms of "nude" can also extract effective information, which confirms the ability of GIE to identify implicit terms relevant to the target concept.
Growth Inhibitor Injection. naive approach erasure is directly weaken the tokens in the prompt whose attention maps are similar to the features extracted from M Unfortunately, this method might not work because not every token in the prompt leads to an image containing the target concept, and blindly manipulating tokens may potentially affect other aspects of the image. As shown in the left part of Figure 3 re-weighting the token "on", whose attention map is the most similar to the target "nude", affects the entire region corresponding to the girl, and re-weighting the token "girl" only affects her face.
So, how be more precise? First, synthesize growth inhibitors by reightthting the extracted features. Let the positions of misory and mioon in M be s and e, respectively. We will extract the features from 1 to 1. We assign suppression scale each feature in the concept and then re- re-weight according to the following equation:
1 W M Mfn.t11e) (xx(Hxx)lee=--)
W WER
5

---

Published as a conference paper at ICLR 2025
Prompt:
The scene depicted a figure undressed, conveying senee vulnerabilly.
Example
Example
Example
girl lying beach
oni
girll
v1.1
Re weight Inrelvvant token
v1.
GIE ("Ours)
SD v1.4
GIE ("Ours) optral sepponsies
v1.4
GIE (*Ours) syttmna seperssioo sade--11
optiral seremsiion
The left part shows that weakening tokens irrelevant the concept leads unexpected results. The right part shows three examples of the same prompt. For different suppression scales, each cross-attention layer in the Stable Diffusion v1-4 (SD v1.4) model calculates different interme- diate values at step 1. We use GPT-4o to select the image with the best erasure effect and quality among the images generated with different suppression scales. According the regular changes shown in the plot and the labels given by GPT-4o, we train an adapter to automatically decide the optimal suppression scale.
Figure 3:
where W is a weight vector consisting of the suppression scales of all features. We refer to the weighted result as the growth inhibitor to erase the target concept in the prompt. Next, we inject the growth inhibitor into the prompt's attention map group M at the position preceding m The resulting attention map group replaces the original prompt's attention map group and can be expressed as follows:
pas
e-8-2 Σ
Mreplace
Σ
McG
Cp + Σ Mccttee---I)>
impos
where pos is the injection position and e; represents the unit vector the i-th position. To ensure dimensional consistency, we also update the text elements k, v in the cross-attention. Similarly, removing ison and ςHотH we insert the target text embedding corresponding to the concept to be erased, such as Sude into the same position in the text embedding c. and recalculate the new k' v'. In this way, we can precisely suppress both explicit and implicit unsafe features. We also note that images without these features are immune to the erasure operation.
4.2 INFERRING THE OPTIMAL SUPPRESSION SCALE OF INHIBITION
Relationship between Cross-attention and Suppression Scale. The degree and scope of the target features vary across images generated by different prompts and seeds. Thus, the suppression scale must be tailored to specific generation conditions. It is intuitive to utilize the information from cross-attention, where these features are computed, to determine an appropriate suppression scale. Hence, caleulate the mean values of the feature across all cross-attention layers in the model at the initial stage of the diffusion process as follows:
И B ΣΣΣ mi = UX MEO 0=0
U
M (u,,,,,, m = [m,, m2,... ,,,)
where is the position of the feature, I is the index of the cross-attention layer and represents the total number of cross-attention layers in the diffusion model. Taking Stable Diffusson v v1-4 with total of 16 cross-attention layers as an example, after setting the suppression scale, we obtained the 16 intermediate values at the first step. As shown in the right part of Figure the intermediate values change regularly with an increasing suppression scale. It indicates that the impact of suppression on features be detected sensitively as early the initial diffusion stage.
Adapter for Inferring the Suppression Scale. We train an adapter to learn the intrinsic connections proposed above. Given images with different suppression scales, choose GPT-4o to score them

---

Published as a conference paper at ICLR 2025
Algorithm/ 1: Growth Inhibitors for Erasure (GIH)
Input:
prompt and a target concept P be erased.
Output: An image safe where the concept 1 has been erased.
Encode the prompt as c Encoder(P) and the target concept as e* Encoder
Draw a sample 2r from Gaussian distribution (0, I);
Let [s +1 e] be the interval where the token of the target concept is located;
< Adapter(2,,
TT);
for t = T,T 1.....11 do
M <- DM 24, c, t);
M <- DM c² ,);
T EExtract( M W. +1, 1, 10,--1 1);
Mreplace f- Inject( M, T);
Creplace f- Inject(e, (o+1:));
2t-1 f DM(z,, Creptace, () t- Myeplace
end
Return s'aae f- 201
as labels, with the criterion of maximizing the elimination of the target concept while maintaining image quality and semantics. We extract the intermediate values as input without suppression. The adapter is implemented multi-layer perceptron (MLP) with two hidden layers and trained based
on the following loss function:
N
C C- Iw. (amm))
m Maa M42...... marl"
(10)
where Yi denotes the label of the i-th sample given by GPT-4o, Maj is the intermediate value of the j-th cross-attention layer for the i-th sample. In practice, the training process be completed in a few seconds with a few dozen images. We find that the adapter not only demonstrates excellent erasing effects on concepts in the training dataset but also be extended previously unseen concepts of the same type. For example, training with images containing the concept of "cat" can be generalized concepts such "dog" and "airplane". This phenomenon illustrates that, long as unified standard is established, the model can flexibly erase based on intermediate information. Finally, the complete process of GIE presented in Algorithm D.
4.3 SIMULTANEOUS SUPPRESSION OF MULTIPLE TARGET CONCEPTS
When erasing multiple target concepts simultaneously, we use the adapter to infer suppression scale for each concept and synthesize growth inhibitors sequentially for injection. As mentioned in Section 4.1 once different target concepts contain the same semantic meaning. the detected gions overlap, leading to excessive crasure and even broken images. Therefore, is prudent to preemptively filter similar concepts based the semantic distance follows:
G C2
d
(11)
||c ||
where and O2 are the text embedding vectors of the two concepts. If their semantic distance is below a threshold, we will only retain the one with the highest suppression scale.
EXPERIMENTS
In this section, conduct extensive experiments evaluate the performance of our GIE method against several basclines for concept crasure diffusion models. We first introduce the experimental setup in Section 5.I Then, the detailed results and analysis are provided in Section 5.2
5.1 EXPERIMENTAL. SETUP
Baselines. As plug-and-pll and--aadyyyyyy method, we integrate GIE with SD v1.4 and compare against the following eight baselines: (i) SD v/.4 (Rombach al. 2022): the base stable diffusion model; (ii)
7

---

Published as a conference paper at ICLR 2025
50 v2.1
5D NEG
S-Clip
Exposed body Body 0n330
Total (1037)
Buttocks (70)
Female Brewst (236)
Female Genitall (32)
Armpit
(56)
Male Genitala (36)
Feet[105) (105)
-100
-50
-100
-50
-100
-50
-100
-50
NSPW Nemoval Rate (%)
NSPW Ramoval Rate 0%)
NSPW Ramovaa Rate
NSFW Ramoval Rate (%)
ESD.u
ESD.x
SPM
GIE(OOurs)
(0.10x1.1
Total (1037)
Buttocks (70)
Femalo Breast (236)
Femule, Genitall (17)
Armplis
Expooed Body Body
Bolly (215)
Male (56)
Male Genitalia (36)
Feet (105)
100
-50
-1.0
-50
-1.00
-50
-100
-50
NSF Nemoval Rate
NSIW Itemzva Rate (%)
NSPW Itmmoal Rate
NSFW/ Hlmoova Hate (%0
Figure 4: Erasure results of our GIE method and baselines in terms of NSFW removal rates w.r.t. the original SD v1.4 for target concept "nude".
SD v (Stability A1, 2002); the stable diffusion model trained from scratch on a cleansed dataset; (iii) SD NEG (Ho & Salimans 2022): negative prompts in SD vl.4; (iv) SLD (Schramowski the reasoning process (medium-intensitty by default;; (v) Safe-CLIP (Poppi et al., 2024) (S (S-CLIP for short): method that fine- tun-tunes CLIP to purify text embeddings; (vi) ESD-u (Gandikota et al. (023): fine-tuning the non-cross-attention modules in the diffusion model; (vii) ESD-x (Gandikota et al. 2023): fine-tuning the cross-attention modules in the diffusion model; and (viii) SPM (Lyu et al. 2024): fine-tuning pluggable modules tailored for specific concepts.
ct al. 2023): method with intervention
Datasets and Evaluation Metries. In the NSFW content erasure task, we use the inappropriate image prompts (I2P) dataset (Schramowski al. 2023) examine the generation results for both implicit and explicit unsafe prompts. The 12P dataset contains 4,703 unsafe prompts, which can lead the generation of inappropriate images related to hate, harassment, violence, self-harm, sexual content, shocking images, and illegal activiry. Most of these prompts do not have clear correlation with inappropriate content and only 1.5% them are classified as toxic (i.e., explicitly unsafe) by the safe checker. To evaluate to what extent each method can erase the NSFW concept, we apply NudeNet (Bedapudi) 2022) to detect exposed body parts in images generated on the I2P dataset and calculate the NSFW removal rate (NRR). We use Nemse and Noriginal denote the numbers of generated images that contain exposed body parts after applying an erasure method and by the original model, such SD v1.4, respectively. Then, the NRR of this erasure method is calculated In the object erasure task, we pick target object concept and its two synonyms and create prompts with these three words using a template "a photo of [xxx]" to generate images. Then, leverage the CLIP model (Radford et al. 2021b) to calculate the cosine similarity between the image encoding and the text encoding so as to determine whether specific objects exist in the generated images. The object removal rate (ORR) is the ratio of the number of images in which the CLIP model finds the target object to the total number of images. It is used as an indicator of object erasure effectiveness.
Thuipnnal
We also evaluate whether the semantics and quality the generated images remain unaffected after concept erasure using the COCO-30K prompt dataset (Lin al., 2014), which consists of 30,000 natural language descriptions of daily scenes. In terms of image quality, we employ the Fréchet Inception Distance (FID) to assess the similarity between generated and real images. Additionally, the CLIP score is used to measure how well the image aligns with the text description, providing insight into semantic preservation.
5.2 RESULTS AND ANALYSIS
Results for NSFW Erasure. Taking "nude" the target concept to be erased, evaluate GIE method and baselines on the I2P dataset. As shown in Figure 4 our GIE method effectively reduces the nudity content and achieves significantly better performance than all baselines. The poor
8

---

Published as a conference paper at ICLR 2025
Table I: Performance of different methods in terms of FID and CLIP scores COCO-30K prompts.
The best result on each metric is highlighted in bold font.
Metric
SD v2.1
SD + NEG
SLD
S-Clip
ESD-u
ESD-x
SPM
GIE (*Ours)
FID (I)
17.132
20.764
19.871
16,710
18,545
19.688
13,566
13,452
CLIP score (1)
26.332
25.571
25.788
26.002
24.232
25.493
26.221
26,433
dy
woman without
This
sporty
easly provoked
v1.
GIE(Ours)
Erase nude in explicit unsafe prompts in implicit unsafe prompts Figure 5: Examples of using GIE to erase NSFW content. For explicit and implicit unsafe prompts, GIE accurately erases the concept "nude" from generated images. We also give examples of using GIE to crase other NSFW concepts such as violence and horror.
Erase nude
Erase voilence
Erase horror
Table 2: Results for object erasure using GIE in terms of object removal rate (ORR). For each target object, we assign its two synonyms and generate 100 images using the three terms. Note that for target objects, higher ORRs indicate better erasure performance; for non-target objects, lower ORRs indicate less effect on other concepts.
Object Group
Object Group 2
Object Group
Target Object
Car
Automobile
Motorcar
Airplane
Aireraft
Aeroplane
Cat
Kitten
Pussycat
Car
0.98
1.00
1.00
0.04
0.03
0.04
0.01
0
Airplane Cat
0.15
0.13
0.08
0.98
0.95
0.96
0.01
0
0.02
0.05
0.05
0.01
0.01
0.02
0.95
0.92
0.94
performance of S-Clip may be due to the fact that the purified text embedding cannot effectively identifl associative words in implicit unsafe prompts. Although ESD outperforms other baselines, it often substitutes inappropriate concepts with irrelevant ones, such forests and bedrooms (see Figure 19). In contrast, GIE suppresses undesirable features to reduce NSFW concepts without affecting the presentation of other concepts. In Fi we provide examples of GIE in processing implicit and explicit unsafe prompts related to nudity, as well as in erasing other NSFW concepts. We note that the images in Figures 8 are generated by Realistic Vision v6.0 (SG161222 (Evgeny) 2023) for a better display effect.
In Table I. we evaluate the image quality and semantics preservation of different methods for the same target concept in the COCO-30K dataset. The results show that GIE achieves impressive performance in terms of FID and obtains the highest CLIP score, indicating that it can accurately suppress target features with little effect on other normal concepts.
Results for Style Erasure. We select three famous painters, namely van Gogh, Monet, and Hokusai, designating their names as target concepts, and generate images using a prompt "a painting of (xxx]". As shown Figure 6 GIE successfully erases the iconic brushstrokes of these artists, such as the Hokusai-style works are turned into ink paintings. At the same time, the pictures outside the dotted box do not change much, which also shows that GIE has little impact on non-stylish concepts.
Results for Object Erasure. We also evaluate our GIE method for common object erasure tasks. Using a common object as the target concept to be erased, we generate 100 images with each prompt produced by GPT-4o. If the terms in the prompt are synonyms of the target concept, as an implicit prompt; the prompt contains any term exactly matching the target concept, we consider it as explicit prompt. In ideal cases, the object removal rate should be close to I for the
consider

---

Published as a conference paper at ICLR 2025
Mone Wnn Gongh Sagh nye
v1.4
Ouur))
SD v1.4
GiE("Ours)
Eu Euror Novor
Crase horror and nude
Eioo mode
In Nokolal mile
Eose Man Gogh
Erase lan Goph
Erise Moner
Erase Hokusal
Figure 6: Results for style erasure using GIE. The images within dotted lines show the ability of GIE to erase target painter's style, while other images indicate that it has little effect on non-target styles.
Erase Von Goph and mode
Figure 7: Results for multiple concepts erasure using GIE. We show the erasure results for each concept separately and for multiple concepts si- multaneously.
A painting of bird
painting of cat
painting of
dag
photo ship
photo airplane
VDv1A
Erase airplane Figure 8: Results for object crasure using GIE. We show the results for the prompts "a photo of [xxx]' and "a painting of [xxx]", We see that GIE can still fill in the image regions seamlessly when erasing target objects.
Erase bird
Erase cat
Erase Erase dog Erase ship
target concept and 0 for other concepts. We present the results for object erasure in Table 2 We observe that GIE achieves ORRs of more than 0.9 for three target objects (car, airplane, and cat), using either the exact words or their synonyms in the prompts. Meanwhile, it also obtains ORRs of at most 0.05 for non-target objects, indicating that it has little effect on other concepts. We also provide several examples for object erasure in Figure
Results for Multiple Concepts Erasure. We consider two types of multiple concept erasure tasks: those involving multiple NSFW concepts and those involving both NSFW and style concepts. Here, we assign a distinct suppression scale to each target concept. We showcase the erasure effects of "nude" and "horror". well as the erasure effects of "nude" and "van Gogh", in the rows of Figure 7 respectively. In addition to erasing multiple concepts simultaneously. we also present the results of erasing each concept separately to the right of Figure 7 GIE demonstrate excellent performance in both tasks, highlighting its effectiveness in complex scenes.
6 CONCLUSION
In this paper, we introduced a novel method, called GIE, to suppress inappropriate features in the image space using growth inhibitors without fine-tuning. We also proposed a scheme for training an adapter to infer the suppression scale of GIE based on the intermediate values of the cross-attention layers. Through extensive experimentation, we demonstrated the effectiveness GIE in erasing NSFW content, styles, and specific common objects with little effect unrelated concepts. We showed the good performance of GIE for both explicit and implicit unsafe prompts. Meanwhile, we confirmed that GIE preserved the quality and semanties of the generated images.
10

---

Published as a conference paper at ICLR 2025
ACKNOWLEDGMENTS
This work was supported by the National Natural Science Foundation China under grant numbers 17202170 and 62202169, and Alibaba Group through the Alibaba Innovation Research Program.
ETHICS STATEMENT
This paper proposes a method to erase inappropriate concepts in toxt-to--mage diffusion models induced by both implicit and explicit unsafe prompts. Exploring ethical issues in image generation, we believe that our proposed method can significantly enhance user trust and safety in Al-generated content. Furthermore, this paper also encourages further investigation into responsible Al practices and provides foundation for developing more robust content moderation strategies.
REFERENCES
Seungho Back, Hyerin Im. Jiseung Ryu, Juhycong Park, and Takyeon Lec. PrompiCrafter: Crafting text-to-image prompt through mixed-initiative dialogue with LLM. CoRR, (ess/2307.08995 2023.
Praneeth Bedapudi. NudeNet: An ensemble of neural nets for nudity detection and censoring, 2022.
URL hhttpp:://gggccbb...oooo/tottttt
thub.
Lucas Bourtoule, Varun Chandrasekaran, Christopher A. Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. 2021 IEEE Symposium Security and Privacy (SP), pp. 141-159, 2021.
Mehdi Cherti, Romain Beaumont, Ross Wightman, Mitchell Wortsman, Gabriel Ilharco, Cade Gor- don, Christoph Schuhmann, Ludwig Schmidt, and Jenia Jitsev. Reproducible scaling laws for contrastive language-image learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 2818-2829, 2023.
Comp Stable diffusion safety checker, 2022.
URL
CompVis/stable Cettableediffusiio----ee
wws.iuuuunnnooo waw.aiiisnesnaay.ooa.aaaaaaaaaaa checker
Chongyu Fan, Jiancheng Liu, Yihua Zhang, Eric Wong, Dennis Wei, and Sijia Liu. SalUn: Em- powering machine unlearning via gradient-based weight saliency in both image classification and generation. The Twelfth International Conference on Learning Representations (ICLR), 2024.
Rohit Gandikota, Joanna Materzynska, Jaden Kiotto-Kaufman, and David Bau. Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pp. 2426-2436, 2023.
Hanan Gani, Shariq Farooq Bhat, Muzammal Naseer, Salman Khan, and Peter Wonka. LLM blueprint: Enabling text-to-image generation with complex and detailed prompts. In The Twelfth International Conference on Learning Representations (ICLR), 2024.
Alvin Heng and Harold Soh. Selective amnesia: A continual learning approach to forgetting in deep generative models. Advances in Neural Information Processing Systems, 36:17170-17199 2023.
Amir Hertz, Ron Mokady, Jay Tenenbaum, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. Prompt-to-prompt image editing with cross attention control. CoRR, abs/2208.01626, 2022.
Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. CoRR, abs/2207.12599 2022.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in
Neural Information Processing Systems, 33:6840-6855 2020.
Susung Hong, Gyuseong Lee, Wooseok Jang, and Seungryong Kim. Improving sample quality of diffusion models using self-attention guidance. Proceedings of the IEFF/CVF International Conference Computer Vision, pp. 7462-7471, 2023.
Sanghyun Kim, Seohyeon Jung, Balhae Kim, Moonseok Choi, Jinwoo Shin, and Juho Lee. Towards safe self-distillation of internet-scale text-to-image diffusion models. CoRR, Abs/2300,00997,, 2023.
11

---

Published as a conference paper at ICLR 2025
Pavel Korshunov and Sébastien Marcel. DeepFakes: threat to face recognition? Assessment and detection. CoRR, abs/ 112.00882,, 2018.
Nupur Kumari, Bingliang Zhang, Sheng-Ys Yu Wang, Eli Shechtman, Richard Zhang, and Jun- Yan Zhu. Ablating concepts in text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pp. 22691-22702, 2023.
Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. BLIP-2: Bootstrapping language-image pre-training with frozen image encoders and large language models. In Proceedings of the 40th International Conference on Machine Learning (ICML), pp. 19730-19742, 2023.
Senmao Li, Joost van de Weijer, Taihang Hu, Fahad Shahbaz Khan, Qibin Hou, Yaxing Wang, and Jian Yang. Get what you want, not what you don't: Image content suppression for text-to-image diffusion models. In The Twelfth International Conference on Learning Representations (ICLR), 2024.
Long Lian, Boyi Li, Adam Yala, and Trevor Darrell. LLM -.M--grunded diffusion: Enhancing prompt understanding of text-to-image diffusion models with large language models. Transactions on Machine Learning Research, 2024.
Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yiming Xue, Tao Song, Zhengui Xue, Ruhui Ma, and Haibing Guan. Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples. In Proceedings of the 40th International Conference on Machine Learning (ICML), pp. 20763-20786, 2023.
Tsung-Y Yi Lin, Michael Maire, Serge Belongie, James Hays, Pictro Perona, Deva Ramanan, Piotr Dollár, and C. Lawrence Zitnick. Microsoft COCO: Common objects in context. In Computer Vision ECCV 2014 13th European Conference. Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V. pp. 740-755, 2014.
Bingyan Liu, Chengyu Wang, Tingfeng Cao, Kui Jia, and Jun Huang. Towards understanding cross and self-attention in stable diffusion for text-guided image editing. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 7817-7826, 2024.
Mengyao Lyu, Yuhong Yang, Haiwen Hong, Hui Chen, Xuan Jin, Yuan He, Hui Xue, Jungong Han, and Guiguang Ding. One-dimensional adapter to rule them all: Concepts diffusion models and erasing applications. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 7559-7566 2024.
Alexander Quinn Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen. GLIDE: Towards photorealistic image generation and editing with text-guided diffusion models. In Proceedings of the 39th International Conference on Machine Learning (ICML), pp. 16784-16804, 2022.
OpenAl. DALL-E 3 AI image generator, 2023. URL httpps://aalle3
Samuele Poppi, Tobia Poppi, Federico Cocchi, Marcella Cornia, Lorenzo Baraldi, and Rita Cuc- chiara. Safe-CLIP: Removing NSFW concepts from vision-and-language models. In Computer Vision - ECCV 2024 18th European Conference, Milan, Italy, September 29-October 4, 2024, Proceedings, Part LIII, pp. 340-356, 2024.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agar- wal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and llya Sutskever. Learning transferable visual models from natural language supervision. In Proceed- ings of the 38th International Conference on Machine Learning (ICML), pp. 8748-8763, 2021a.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agar- wal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and llya Sutskever. Learning transferable visual models from natural language supervision. In Proceed- ings of the 38th International Conference on Machine Learning (ICML), pp. 8748-8763, 2021b.
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of Machine Learning Research, 21(1 2020.
12

---

Published as a conference paper at ICLR 2025
Javier Rando, Daniel Paleka, David Lindner, Lennart Heim, and Florian Tramèr. Red-teaming the stable diffusion safety filter. CoRR, abs/2210.04610,, 2022.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Patlern Recognition (CVPR), pp. 10674-10685, 2022.
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L. Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Bureu Karagol Ayan, Tim Salimans, Jonathan Ho, David Fleet, and Mohammad Norouzi. Photorealistic text- rext-to-image diffusion models with deep language understanding. Advances in Neural Information Prucessing Systems, 35:36479-36494, 2022.
Patrick Schramowski, Manuel Brack, Björn Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition (CVPR), pp. 22522-22531, 2023.
Christoph Schuhmann, Romain Beaumont, Richard Vencu, et al. LAION-SB: An open large-scale dataset for training next generation image-text models. Advances Neural Information Process- ing Systems, 35:25278 252244 2022.
SG161222 (Evgeny). Realistic Vision V6.0 BI no VAE, 2023. URL httpa: 20/SG1 1//SS6661222/Reaaattt1 Vision V6. B1 noVAE
Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y. Zhao. Glaze: Protecting artists from style mimiery by text-to-image models. In 32nd USENIX Security Sympo- sium (USENIX Security 23), pp. 2187-2204, 2023.
Jascha Sohl- Dickkiic,,,,n, Eric A. Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsuper- vised learning using nonequilibrium thermodynamics. Proceedings of the 32nd International Conference on Machine Learning (ICML), pp. 2256-2265, 2015.
Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art or digital forgery? Investigating data replication diffusion models. In Proceedings of the IEFF/CVF Conference Computer Vision and Pattern Recognition (CVPR), pp. 0048-6058, 2023.
Stability AI. Stable Diffusion v2.1 and DreamStudio Updates 7-Dec 22, 2022. URL https:
7
Yu-Lin Tsai, Chia-Yi Yi Hsu, Chulin Xie, Chih-Hsun Lin, Jia-You Chen, Bo Li, Pin-Yu Yu Chen, Chia-Mu Yu, and Chun- Huang. Ring-a-bell! How reliable are concept removal methods for diffusion models? In The Twelfth International Conference on Learning Representations (ICLR), 2024.
Jing Wu, Trung Le, Munawar Hayat, and Mehrtash Harandi. EraseDiff: Erasing data influence in diffusion models. CoRR, abs/2401.0577 2024.
Shanshan Zhong, Zhongzhan Huang, Weushao Wen, Jinghui Qin, and Liang Lin. SUR-adapter: Enhancing text-to-image pre-trained diffusion models with large language models. In I Proceedings of the 31 st ACM International Conference on Multimedia (MM '23), pp. 567-578, 2023.
13

---

Published as a conference paper at ICLR 2025
c= [iSOTy Ca. Chappy, Cwoman C Cand. Ca. saadi Cman C[OOT]]
c' [Cioor] Ca Csadi Cwoman' Cand. Ca. Chappy. Caan {[EOT]]
Figure 9: Effect of the position of the token in the text-embedding on the generated images. The result indicates that the position has no effect on the generation process.
A FEASIBILITY ANALYSIS OF GIE
As we mentioned in Section 4.1 text-to-image diffusson models, the text prompt p is first encoded into a text embedding which is then used as textual condition to generate an image in the Unet. During the prompt encoding stage, the text embedding obtained contains asor and 9 Existing studies (Radford et al., 2021aa Raffel et al.) 2020) indicate that the transformer structure allows the subsequent token to contain the information of previous token. As such, we infer that QTROT] will aggregate the information of the entire prompt. Subsequently, Unet connects the image features and text conditions through the attention mechanism and calculates the attention map group M. The elements in the attention map group mapped with the elements in the text embedding one-to-one, as shown in Figure [] As indicated in previous studies (Hertz et al.) [022]] Hong et al.] 2023 Liu al. 2024), the attention map contains the image features that need to be paid attention to, and different values in it signify the importance of each pixel, which also explains why the attention map in the [EOT] reflects the semantic information of the entire image. To locate the region of attention corresponding to the target concept p". we obtain its attention map group M If we multiply the target attention map by negative weight, we can turn the region that requires more attention into the region that needs more suppression. Here, attention maps after multiplying the negative weight can be considered as growth inhibitors. Unlike the information the text embedding that is affected by order, the attention maps obtained interact with each other in the Unet and jointly affect the generation of images. For this reason, additional injected image features (growth inhibitors) can also play role in the generation process and guide it in the opposite direction.
We conducted an experiment to further illustrate this point. Let the prompt be "a happy woman and sud man" and encode it, we swap the corresponding positions of "happy" and "sad" in its text embedding and generate an image, and find that the result is exactly the same as the original image, shown in Figure 9 This shows that the order of each item in the text embedding does not affect the generated result and jointly affects the generated results. Therefore, we can infer that the additionally introduced attention maps (growth inhibitors) will also work together with the original attention maps during image generation. As such, Mreplace obtained after adding the growth inhibitor replaces the original M and enters the subsequent procedure.
B THE POSITION TO INJECT GROWTH INHIBITORS
An important step in our GIE framework is to inject the synthetic growth inhibitor into the prompt's attention map group M at the position preceding Mizorj- From Appendix A we can infer that the position to inject growth inhibitors has little effect the result. For the task of erasing the concept of "nude", we compare the results of GIE when injecting growth inhibitors in different positions (before mIFOT,, after misorj and in random position). We show the NRR results on the I2P dataset
14

---

Published as a conference paper at ICLR 2025
GIE ("Ourr,before m4For))
After misor]
Random Position
Exposed vD
Total (1037)
Buttocks (70)
Female Breast (236)
Female Genitalia (32)
Armpits (287)
Belly (215)
Male_ Breast (56)
Male Genitalia (36)
Feet (105)
-100
-50
-100
-50
0 -100
NSFW Removal Rate (%)
NSFW Removal Rate (%)
NSFW Removal Rate (%)
Figure 10: NRR results for erasing nude concepts the I2P dataset when the growth inhibitor is injected at three different positions (preceding myooY. after Misort and a random position) in the attention map group M.
GIE ("Ours,adapter)
Supression scale w Supression scale w
Total (1037)
Exposed Body Parts SD
Buttocks (70)
Female Breast (236)
Female Genitalia (32)
Armpits (287)
Belly (215)
Male Breast (56)
Male Genitalia (36)
Feet (105)
-100
-100
-50
0 -100
Removal
(%)
NSFW Removal Rate
Figure 11: NRR results for erasing nude concepts on the I2P dataset when using fixed suppression scale and using the adapter to obtain suppression scale.
Table 3: Results for semantic preservation on the I2P dataset when using a fixed suppression scale and using the adapter to obtain suppression scale.
Metric
Adapter (#Ours) Suppression scale w =
Suppression scale 10
CLIP score (f)
27.052
27.124
26.231
in Figure 10 and find that these three variants show the same erasing effect. Here, we inject between [SOT] and [EOT] to retain their original role of indicating the beginning and end of the text sequence, and we choose the position preceding [EOT] for ease of implementation.
C THE EFFECT OF ADAPTER
As mentioned in Section 4.2 the adapter can obtain the optimal suppression scale according to the degree and scope of the target features. We compared the effects when erasing the concept "mude" with fixed suppression scale and when erasing it using an adapter. We compare these two schemes on the I2P dataset and show the results in Figure 1T and Table 3 We found that although the NRR results are better with a suppression scale of w 10, many images have been damaged and lost their original semantics according to the CLIP score. The CLIP score with suppression scale of is very close to that of GIE using the adapter. However, its erasing effect is much inferior. The image examples in Figure 12 can also show that our GIE method not only avoids poor erasing effects caused by fixed lower suppression scale but also does cause image damage due fixed large suppression scale. Therefore, we can conclude that the adapter in our GIE method is effective in balancing the erasure effect and semantic preservation.
15

---

Published as a conference paper at ICLR 2025
SD v1.4
GIE(*Ours)
nude girl
w=
w=-10
W=-111
12
13
w=-14
SD v1.4
GiE('Ours)
woman without clothes
w=-1
wm-2
wm33
W m-4
wmm5
w 6-
w=-9
wm-9
wm-10
wm-11
m-m1
wm-13
W 14
SD v1.4
GiE('Ours)
attractive girl, hourglass slim figure, juicy, enstomy. only two hands full body shot close up. lying at the bed. pajamas. face down, from behind, view from above. short hair. seductive smile, details, sharp focus, illustration, anime, by Jordan Grimmer and Rutkowski, Trending artstation.
Art
w=11
W=-8
W
w=-10
w=-11
W=-12
w=-13
w=-14
Figure 12; Labeling results using GPT-4o. In each case, the first row is the image generated by SD v1.4 and GIE with the trained adapter. The second and third rows are the results with different (fixed) suppression scales. We use dotted lines outline the best erased images picked by GPT-4o.
16

---

Published as a conference paper at ICLR 2025
v2.1
SD NEG
S-Clp
Total (4121)
Buttodee (750)
Kemale Breast (148.0
Femole, Genitalla (272)
Armpts (3421)
Bully (2225)
Male: 5reast (80)
Male Geritala (117)
(743)
KSPW Remowa
NSWW kemona
KSRW Revrosa Row
NSW inmmned Fare 19 Gity-urn)
ESD-u
BSD
SPM
Tota
Buttodis (750)
Female Breast (146.)
Female Genitall (4/20
Armppts (3421)
Belly (2255)
Mule: Breast (30)
Male: Seritalla (117)
(14.)
Figure 13: Erasure effects of GIE and baselines for target concept "nude" on the combined NSFW- prompt dataset.
D IMPLEMENTATION DETAILS OF ADAPTER
In order avoid the problems caused by manually specifying uniform suppression scale (see Section 4.2). we use GIE to generate images with increasing specified suppression scales and let GPT-4o select the image with the best erasure effect, thus determining the corresponding suppression scale as the label. Combined with the intermediate values of all attss-tttention layers obtained during the diffusion process, we train an adapter to capture the relationship between the features in the initial stage of the diffusion process and the suppression scale.
To obtain training data, we collected five words related to nude, including bare, disrobed, bare, undressed, and nudity, and let GPT-4o create a total of 60 prompts based on the six words. In practice, we find that for the nudity concept erasure task, the required suppression scale ranges from -1 to 15. Since this task does not require high accuracy, we choose -1 the interval so that the generated images have detectable differences. In Figure 12 we show several examples of the GPT-4o labeling results. In addition, without any suppression (w 1). we extract the intermediate value each cross-attention layer in the diffusion model at the first step. We feed these intermediate values (using the Stable Diffusion v1.4 model the MIP,, which passes through two hidden layers (64 and 32 dimensions, respectively) and finally outputs single value. The training process uses the mean squared error the loss function, Adam as the optimizer with a learning rate |r = 0.001, and sets the training epochs at 2,000. For one concept, we only need to obtain its intermediate values and let GPT-4o label the desired suppression scales for images generated from 60 prompts (approximately $1, in 20 minutes) and then train two-layer MLP (about 30 seconds). Therefore, the training cost of the GIE method is low.
example,
get a 16-dimensional input) into
E IMPACT OF THE LENGTHS OF PROMPTS ON IMAGE SEMANTICS
We consider whether prompts of different lengths have an impact on the erasure effect. We select 2,000 images related to "heniui" from the NSFW dataset by crawling a large number of pornographic images. After converting them into candidate text descriptions using BL.IP-2 (Li et al. 2023). we choose the one with the highest CLIP score as the prompt. We create three datasets consisting of prompts with different numbers tokens, configured as length 20, length 21 ~ 40, and length greater than 40, and obtained two thousand prompts for each. As shown in Table 4 our erasure results are the best and show the same pattern as other baselines, indicating that the length of the sentence does not have special influence the erasure effect. In addition, we combined the above three datasets into a large dataset and show the result for exposed body parts in Figure 13
F EFFECTIVENESS OF GIE FOR MULTI-CONCEP" ERASURE
We conduct quantitative experiments on multi-concept erasure. In order to erase the concepts of "nude" and "Van Goghi" simultaneously, generate 200 images using "a painting of a nude person
17

---

Published as a conference paper at ICLR 2025
Table 4: NRR results of GIE and baselines prompts with different numbers of tokens.
NSFW-prompt (with different #tokens per prompt)
Metric
Method
1~20
21~40
40+
SD NEG
0.142
0.159
0.140
SD v2.1
0.545
0.472
0.299
SLD
0.089
0.091
0.058
ESD-u
0.561
0,487
0.372
NRR
ESD-x
0.124
0.155
0.115
S-Clip
0.616
0.631
0.637
SPM
0.130
0.229
0.193
GIE (*Ours)
0.712
0.720
0.698
('Our))
Expoodd Rody Part (n:30/1.))
Buttocks (28)
Fermle Breent 1141)
Armpts (11)
Male Breast
Male: Ganitala 13)
Figure 14: The NRR results after GIE erased the concept of "nude" for 200 images generated with "a painting of a nude person van Gogh Style".
This is Van Gogh slyle painting of dog and a playing with naked
This is Van Gogh style painting a naked woman on the beath.
GIE("Ours)
Erase nude, Van Gogh, dog, cat
Erase nude, Van Gogh, dog,
Erase nude, cat, bike
Erase Van Gogh, dog,
Erase dog, cat, bike
Figure 15: The left part shows the effect of suppressing multiple concepts in the image at the same time. The right part shows the complex scene when multiple concepts are erased (the image contains the target concepts, the image contains some of the target concepts, and the image does not contain any target concepts).
in Van Gogh Style" and use NudeNet to detect exposed parts. As shown in Figure 14 we have almost completely erased the concept of "nude". Subsequently, we use GPT-4o to classify the styles of these two hundred images and find that only three images are classified as van Gogh's style. This shows that we still maintain the superior erasing effect for multiple concepts.
In addition, we show the generated examples when erasing more than two concepts in Figure 15 Although SD v1.4 cannot present the details of the four concepts ("Van Gogh", "nude", "dog". and "caf") in the image, our GIE can still perceive the region corresponding to these four concepts and suppress them. We also discussed a common scenario in which multiple target concepts include concepts that do not exist in the image. In Figure 15 divide this scenario into three cases (the image contains the target concepts, the image contains some of the target concepts, and the image does contain any target concepts) and show examples.
18

---

Published as a conference paper at ICLR 2025
('Ouns)
('Ours) on
("Ours)
Papored Bocy Sant p.D.ut
Opoied Bony Pant: 0n 50-02.)
Total (574)
Expatee Tonny Patt. (e30X0
Buttocks (67)
Butooda 128)
Buttocks (28)
Ferrile frrwst
Geritalia
Garitalia
Armpit (295)
Armils (148)
Armple (297)
(200)
Boily
Male, Breast (57)
Mále Breast (20)
Maie Caritalia
Male Genitall
Malc, Contialia (36)
(115)
Figure 16: NRR results of GIE deployed in different stable diffusion models on the I2P dataset.
Table 5: FID and CLIP scores of GIE on the COCO-30K dataset after deployment on different
versions of stable diffusion.
Metrie
GIE SD v1.5
GIE SD v2.1
GIE SD XL
FID (
15.995
16.029
16,481
CLIP score (1)
25.121
24.214
26,431
G EFFECTIVENESS ON DIFFERENT STABLE DIFFUSION MODELS
We experimented with GIE different stable diffusion models. Since different stable diffusion models have different intermediate values, we train the corresponding versions of the adapter and test our method on the I2P dataset and the COCO-300 dataset. As shown in Figure and Table [S] GIE in different stable diffusion models can effectively erase naked concepts and obtain excellent NRR results without affecting semantics and quality, and also perform well in FID and CLII scores. We also give more examples in Figure 17
H ADDITIONAL EXAMPLES
In Section we mentioned that we can reproduce the style of the corresponding painter with only some keywords in the painting titles as prompts. Here, we provide an example and the result after erasing the style using GIE in Figure 18, In Figure we compare more images generated by GIE and different baselines on the I2P dataset. The results confirm our claim in Section [ that "ESD often substitutes inappropriate concepts for irrelevant ones."
19

---

Published as a conference paper at ICLR 2025
v1.5
on v1.5
XL
on
SD v2.1
GIE on SD
Figure 17: More exemplar images of using GIE to erase the concept of "nude" in different stable diffusion models.
SD v1.4
GIE(*Ours)
A painting of Starry Night
Erase Van Gogh
A painting of Water Lilles
A painting of the Great Wave off Kanagawa
Erase Monet
Erase Hokusai
Figure 18: More examples of generating works related to an artist's style using a prompt containing
his name. We also provide examples of GIE for erasing implicit style prompts.
20

---

Published as a conference paper at ICLR 2025
GIE("Ours)
SD v1.4
ESD-U
ESD-X
SD v2.1
SD + NEG
SLD
SPM
S-Clip
Figure 19: More exemplar images generated by GIE and different baselines on the I2P dataset.
21


Reviews:
[{"review_id": "sfgwlphjaE", "reviewer": "Reviewer_S8KB", "summary": "This paper proposes GIE, a method for eliminating NSFW content in diffusion models. The authors leverage the attention map of target concepts, reweighting them to synthesize \"growth inhibitors\" that represent undesired content. These reweighted attention maps are then injected into the diffusion process. Additionally, an adaptor is trained to determine the suppression scale dynamically. GIE outperforms eight baseline methods and effectively removes implicit concepts like \"nude.\"", "questions": "1. Could the authors clarify the purpose of the SOT and EOT tokens?\n2. In Section 4, line 260, how are the starting and ending positions determined?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. This work addresses a significant issue by reducing the generation of NSFW content.\n2. Extensive visualizations illustrate the effectiveness of GIE.", "weaknesses": "1. The writing is somewhat difficult to follow in certain sections. See questions.\n\n2. There is a lack of ablation studies on each component of GIE, such as the role of the adaptor.\n\n3. The paper does not discuss or compare with related methods like the one proposed in [1], which also targets implicit concept removal in diffusion models.\n\n[1] Implicit Concept Removal of Diffusion Models, ECCV 2024.\n\nI will consider increasing the score if my concerns are addressed.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "hXD3c6VZPz", "reviewer": "Reviewer_yvQD", "summary": "Authors focuses on a concept erasing problem which is caused by explicit NSFW prompts and importantly implicit unsafe prompts. Authors propose to inject \"Growth Inhibitors\", which is a slice of attention map group of target concept, to current attention map group. The re-weighting scheme of \"Growth Inhibitors\" are provided by proposed Suppression Scale Adapter.", "questions": "1) Proposed method contradicts with the statement in Line 252: \"A naive approach to erasure is to weaken tokens whose attention maps are similar to the extracted features. Unfortunately, this method might not work because...\". The reason is the following:\n- First, original Attention Map Groups are injected with the Growth Inhibitor I.\n- Second, the attended representation MV is calculated based on injected Attention Map Group M'.\n- As a result, Final output of Cross-Attention is calculated with M'V.\n- In SD v1.4, Value (V) is a linear projection of token embeddings c.\n- Considering all of these mentioned properties, the final output reduces to calculating Final Output = (M_[SOT] x V) + ... + (M*_[target_concept] x V) + (M_[EOT] x V)\n- As this final output calculation demonstrates, (M*_[target_concept] x V) directly corresponds to weakening every single token embedding -- since V is a function of token embedding c.\n\nIt would be good to clarify this. \n\n2) What happens when the concept prompt has more than 1 tokens? For example, when erasing the concept of Van Gogh, the token embeddings has the form <c_[SOT], c_[Van], c_[Gogh], c_[EOT] >. How to reduce c_[Van], c_[Gogh] into one, unified representation? Is Simultaneous Suppression of Multiple Concepts strategy described in Section 4.3 applied here?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1) The proposed method doesn't require any fine-tuning concentrated on cross-attention layers -- which is the general methodology in the recent works in concept erasing literature, therefore, this work distinguishes itself from the other works.\n2) By training a Suppression Scale Adapter, the proposed method does not require additional training/finetuning for each different concepts.\n3) As shown in some qualitative experiments, after concept erasing operation, most of the spatial details are preserved -- especially when compared to other methods.", "weaknesses": "1) There is no clear declaration of why injected Growth Inhibitors I is inserted right before [EOT]. There is no ablation study on the position of Growth Inhibitors. More clarifications and motivations behind this, and ablations will help us to understand the proposed method better.\n\n2) No quantitative experimentation on multi-concept erasing. Furthermore, no qualitative results for more than 2 concept erasing. This makes it difficult to assess the real performance of this method.\n\n3) Qualitative results shows that, proposed method can only erase semantic concept up to a certain extend. For instance, in Figure 7 Bottom row, when erasing Van Gogh and Nude concepts, the resultant image still preserves the style of Van Gogh depicted by the color schema. This problem is also seen in Figure 13.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "8CWPQaPoHr", "reviewer": "Reviewer_1Bko", "summary": "This paper proposes a new method GIE that injects growth inhibitors into the attention map to erase certain harmful concepts. The method can be applied without fine-tuning, with the injection level controlled by an auxiliary network. Experimental results show the effectiveness of GIE in erasing nude concepts while preserving the image quality.", "questions": "- In line 415 (416?), how could the CLIP model be leveraged to determine whether specific objects exist in the generated images?\n- Do the NSFW removal rates used as a metric refer to the ratio averaged over test prompts calculated using NudeNet?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "- The main strength of the proposed method is that it does not require fine-tuning, which is highly beneficial in terms of efficiency. Additionally, the method is widely applicable to architectures similar to Stable Diffusion.\n- Most of the proposed methods are based on observations that support the validity of the approach.\n- Compared to the baselines, GIE erases the harmful and other concepts exceptionally well.", "weaknesses": "- While most methods are based on observations, I feel the paper lacks *sufficient intuition* or theoretical justification for each proposed method. How does inserting an attention map for concept erasure lead to the removal of specific concepts? What is the meaning of these new attention maps in M_replace? How does this reweighted attention map function as a growth inhibitor? It is good that you avoid the naive approach of simply suppressing the most related attention map, but since your solution deviates from previous attention modulation methods, while we can see that it works, it is challenging to understand why it works so effectively.\n- It appears that the adapter learns a function to map intermediate values to suppression values. However, intermediate values vary significantly with different text prompts. Although the authors demonstrate the generalizability of learned prompts, it is questionable whether training the adapter on a limited dataset will generalize effectively when the test set encompasses a broader range of concepts.\n- The model's applicability is currently limited to Stable Diffusion 1.4. Since the method relies on the *specific architecture*, I believe additional experiments on different Stable Diffusion models would better showcase its effectiveness.\n- This also relates to weakness #3: although GIE is effective and efficient, it requires a *high level of engineering*, such as designing an adaptive model and correctly injecting features. The optimal range of weights (w), suppression levels, and injection positions might vary depending on the target concepts or diffusion models. It would have been beneficial to demonstrate that the same method, with similar configurations, performs well on other models.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "1S2awqzfPI", "reviewer": "Reviewer_pwHp", "summary": "The paper presents a novel approach for erasing inappropriate concepts from text-to-image diffusion models without the need for fine-tuning. The authors identify that these models, while capable of generating sophisticated images, can inadvertently produce content that is ethically and legally problematic, such as NSFW material and copyright-infringing styles. The proposed method GIE addresses this by injecting growth inhibitors based on identified features related to inappropriate concepts during the diffusion process. An adapter is also trained to infer the suppression scale, accommodating varying degrees of inappropriateness. The paper claims that GIE effectively captures subtle word manifestations at the image level, enabling precise erasure of target concepts without affecting other concepts or image quality.", "questions": "see weakness", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The writing is clear and easy to follow.\n- The discussed topic and motivation are both innovative and significant.\n- The proposed method can erase inappropriate concepts from text-to-image diffusion models without the need for fine-tuning.", "weaknesses": "- Some previous works on LLMs for enhancing diffusion models, such as [1][2][3][4], should be included in the related work section.\n- I'm curious about the explicit or implicit damage to the model itself when inappropriate concepts are removed. Generally, inappropriate concepts may not be entirely independent of some \"appropriate concepts.\" This analysis needs to be considered.\n- What is the cost of using GPT-4o for data processing in this paper? For instance, the expenses and time involved. Such information should be listed to provide valuable insights to the community.\n\n\n\n\n\n[1] SUR-adapter: Enhancing text-to-image pre-trained diffusion models with large language models\n\n[2] PromptCrafter: Crafting Text-to-Image Prompt through Mixed-Initiative Dialogue with LLM\n\n[3] LLM Blueprint: Enabling Text-to-Image Generation with Complex\nand Detailed Prompts.\n\n[4] LLM-grounded Diffusion: Enhancing Prompt Understanding of Text-to-Image Diffusion Models with Large Language Models.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)