SPEED: Scalable, Precise, and Efficient Concept Erasure for Diffusion Models
Authors: Ouxiang Li
Yuan Wang
Xinting Hu
Houcheng Jiang
Tao Liang
Yanbin Hao
Guojun Ma
Fuli Feng
Venue: ICLR 2026 Poster (2026)
Keywords: Diffusion Models
Concept Erasure
Model Safety
Primary area: generative models

Abstract: Erasing concepts from large-scale text-to-image (T2I) diffusion models has become increasingly crucial due to the growing concerns over copyright infringement, privacy violations, and offensive content. In scalable erasure applications, fine-tuning-based methods are time-consuming to precisely erase multiple target concepts, while real-time editing-based methods often degrade the generation quality of non-target concepts due to conflicting optimization objectives.
To address this dilemma, we introduce SPEED, a ***scalable, precise, and efficient*** concept erasure approach that directly edits model parameters. SPEED searches for a null space, a model editing space where parameter updates do not affect non-target concepts, to achieve scalable and precise erasure. To facilitate accurate null space optimization, we incorporate three complementary strategies: Influence-based Prior Filtering (IPF) to selectively retain the most affected non-target concepts, Directed Prior Augmentation (DPA) to enrich the filtered retain set with semantically consistent variations, and Invariant Equality Constraints (IEC) to preserve key invariants during the T2I generation process.
Extensive evaluations across multiple concept erasure tasks demonstrate that SPEED consistently outperforms existing methods in non-target preservation while achieving efficient and high-fidelity concept erasure, successfully erasing 100 concepts within only 5 seconds. Our code and models are available at: https://github.com/Ouxiang-Li/SPEED.

Published as a conference paper at ICLR 2026
SPEED: SCALABLE, PRECISE, AND EFFICIENT CON- CEPT ERASURE FOR DIFFUSION MODELS
Ouxiang Li Yuan Wang's Xinting Hu Houcheng J Jack Tao',
Yanbin Hao?, James Ma Fuli Feng it
1 UUniversity of Science Technology of China. Hefei University of Technology
1 Lic Locx@mail ustc.edu. eeduucn en, joyhul 4144 26 iimail... com, falifeng993 gma -i com
400-Gelebriteeg-
-Smoppy
-Snoppy
Hetlo Kitty
SpongeBob
Computation
10'
10'
10'
Gomcopte
10'
350 Specdap
MACE
55% Impproveeent
Dandel
Brasure
AECE
(a) Scalable
(b) Precise
(c) Efficient
Figure 1: Three characteristics of our proposed concept erasure method for diffusion models, SPEED. (a) Scalable: SPEED seamlessly scales from single-concept large-scale multi-concept erasure (e.g., 100 celebrities) without additional design. (b) Precise: SPEED precisely removes the target concept (e.g., Snoepy) while preserving the semanties for non-target concepts (e.g., Hello Kitly and SpongeBob). (c) Efficient: SPEED immediately erases 100 concepts within seconds, achieving new state-of-the-art (SOTA) performance with 350x speedup over competitive methods.
ABSTRACT
Erasing concepts from large-scale eext-to-image (T2I) diffusion models has be- come increasingly crucial due to the growing concerns copyright infringe- ment, privacy violations, and offensive content. In scalable erasure applications, fine-tuiing-based methods are time-consuming to precisely erase multiple get concepts, while real-time editing-based methods often degrade the generation quality of non-target concepts due to conflicting optimization objectives. To ad- dress this dilemma, we introduce SPEED, scalable, precise, and efficient con- cept erasure approach that directly edits model parameters. SPEED searches for a null space, a model editing space where parameter updates do not affect non- von-target concepts, to achieve scalable and precise erasure. To facilitate accurate null space optimization, we incorporate three complementary strategies: Influence-baus based Prior Filtering (IPF) to selectively retain the most affected non-target concepts, Directed Prior Augmentation (DPA) enrich the filtered retain set with seman- tically consistent variations, and Invariant Equality Constraints (IEC) to preserve key invariants during the T2I generation process. Extensive evaluations across multiple concept erasure tasks demonstrate that SPEED consistently outperforms existing methods in non-target preservation while achieving efficient and high- fidelity concept erasure, successfully erasing 100 concepts within only 5 seconds. www.oo/uuiaanng//PEE...... Our code and models are available at: https://gtthu..coo/// cww/Ouxiang----oooomooaaaaaoaoo Li/SPEED.
INTRODUCTION
Text-to-image (T2I) diffusion models (Ho et al., 2020; Song al., 2020a;b; Nichol & Dhariwal, 2021; Rombach et al., 2022; Ho & Salimans, 2022) have facilitated significant breakthroughs in gen- erating highly realistic and contextually consistent images simply from textual descriptions (Dhari- wal & Nichol, 2021; Ramesh et al., 2021; Gal et al., 2022; Betker et al., 2023; Ruiz et al., 2023;
"Equal Contributions.
Corresponding authors.

---

Published as a conference paper at ICLR 2026
Podell et al., 2023; Esser et al., 2024; Xu et al., 2025a;b). Alongside these advancements, concern have also been raised regarding copyright violations (Cui et al., 2023; Shan et al., 2023; Yan et al., 2024), privacy concerns (Carlini al., 2023; Yang al., 2023), and offensive content (Schramowski et al., 2023; Yang et al., 2024b; Zhang et al., 2025). To mitigate ethical and legal risks in genera- tion, it is necessary to prevent the model from generating certain concepts, process termed concept erasure (Kumari et al., 2023; Gandikota et al., 2023; Zhang et al., 2024a). However, removing tar- get concepts without carefully preserving the semanties of non-target concepts can introduce unin- tended artifacts, distortions, and degraded image quality (Gandikota et al., 2023; Orgad et al., 2023; Schramowski et al., 2023; Zhang et al., 2024a), compromising the model's usability. Therefore, beyond ensuring the effective removal of target concepts (i.e., erasure efficacy), concept erasure should also maintain the original semantics of non-target concepts (i.e. preservation).
In this context, recent methods strive to seek balance between erasure efficacy and prior preserva- tion, broadly categorized into two paradigms: training- (Kumari et al., 2023; Lyu et al., 2024; Lu et al., 2024a) and editing-based (Gandikota et al., 2024; Gong et al., 2025). The training-based paradigm fine-tunes diffusion models to achieve concept erasure, incorporating an additional regu- larization into the training objective for prior preservation. In contrast, the editing- bbaen paradigm avoids additional fine-tuming by directly modifying model parameters (e.g., projection weights in cross-attention layers (Rombach al., 2022)), with such modifications derived from closed-form objective that jointly accounts for erasure and preservation. This efficiency also facilitates editing- based methods extend to multi-concept erasure without additional designs seamlessly.
However, as the number of target concepts increases, current editing- baating-bbsed methods (Gandikota al., 2024; Gong et al., 2025) struggle balance between erasure efficacy and prior preservation. This can be attributed to the growing conflicts between erasure and preservation objectives, making such trade-offs increasingly difficult. Moreover, these methods rely on weighted least squares op- timization, inherently imposing a non-zero lower bound on preservation eтror (see Appx. B.2). In multi-concept settings, this accumulation of preservation errors gradually distorts non-target knowl- edge, thereby degrading prior preservation. To address the above limitations, we propose Scalable, Precise, and Efficient Concept Erasure for Diffusion Models (SPEED) (see Fig. 1), an dditing-based method with null-space constraints. Specifically, a model editing space where parameter updates do not affect the feature representations of non- target concepts. By projecting the model parameter updates for concept erasure onto this null space, SPEED can minimize the preservation error to zero without compromising erasure efficacy, thereby enabling scalable and precise concept erasure without affecting non-target concepts.
search for the null space of prior knowledge,
The main contribution of SPEED lies in defin- ing effective null space from set of pre- defined non-target concepts (i.e., retain set).
Baseline
Original
We observe that the existing baseline with null-
space constraints (Fang et al., 2024) confronts a fundamental dilemma during concept erasure:
While a small retain set limits the coverage of prior knowledge, enlarging the retain set makes it increasingly difficult to identify an accurate null space. This dilemma arises because a large retain set drives the corresponding feature ma- trix toward full rank, necessitating the estima- tion of its null space ensure sufficient de- grees of freedom for concept erasure. However, such estimation inevitably perturbs the repre- sentations of the retain set concepts, leading to semantic degradation and compromised prior preservation, as illustrated in Fig. 2.
Retain Bet
500
10000
20000
Figure 2: Semantic degradation with increas- ing retain set concepts. The baseline null-space constrained method (Fang et al., 2024) preserves non-target semantics well given a small retain set However, as the retain set concepts increase, the corresponding matrix approaches higher rank, making the null space estimation increasingly in- accurate (see Eq. 4) with inevitable approximation errors, thereby degrading prior preservation
In this light, we introduce Prior Knowledge Refinement, suite of techniques designed to strategi- cally and selectively refine the retain set so as to mitigate the semantic degradation in searching for the null space. Particularly, we propose Influence-based Prior Filtering (IPF), which first quantifies the influence of concept erasure each non-target concept and then prunes the retain set by remov- ing minimally affected concepts, preventing the correlation matrix from approaching full rank and thus maintaining an accurate null space. Subsequently, to further enhance prior preservation over
2

---

Published as a conference paper at ICLR 2026
the resulting retain set, we propose Directed Prior Augmentation (DPA), which expands the retain set with directed, semantically consistent perturbations to improve retain set coverage. In addition, incorporate Invariant Equality Constraints (IEC), which impose equality constraints
invari- ant representations during generation (e.g.. [SCT] token), ensuring that they remain unchanged throughout concept erasure. We evaluate SPEED on three representative concept erasure tasks, L.e,, few-concept, multi-concept, and implicit concept erasure, where it consistently exhibits superior prior preservation across all erasure tasks. Our contributions can be summarized as follows:
We propose SPEED, scalable, precise, and efficient concept erasure method with null-space constrained model editing, capable of erasing 100 concepts in 5 seconds.
We introduce Prior Knowledge Refinement construct accurate null space over the retain set for effective editing. Leveraging three complementary techniques, IPF, DPA, and IEC, our method balances semantic degradation and retain coverage, enabling precise and scalable concept erasure.
Our extensive experiments show that SPEED consistently outperforms existing methods in prior preservation across various erasure tasks with minimal computational costs.
RELATED WORKS
Concept erasure. Current T21 diffusion models inevitably involve unauthorized and offensive gen- erations due to the noisy training data from web (Schuhmann et al., 2021; 2022). Apart from apply- ing additional filters safety checkers (Rando al., 2022; Betker et al., 2023; Rao, 2023), prevail- ing methods modify diffusion model parameters to erase specific target concepts, mainly categorized into two paradigms. The rraseing-based paradigm fine-tunes model parameters with specific erasure objectives (Kumari et al., 2023; Gandikota et al., 2023; Zhang et al., 2024a;b; Zhao et al., 2024b;a; Huang et al., 2024; Kim al., 2024; Wu al., 2025a) and additional regularization. editing-based paradigm edits model parameters using a closed-form solution to facilitate efficiency in concept erasure (Orgad et al., 2023; Gandikota et al., 2024; Gong et al., 2025). These methods can erase numerous concepts within seconds, demonstrating superior efficiency in practice. Beyond pa- rameter modification, non paraametiiicc methods (e.g., external modules and sampling interventions) have also been explored (Schramowski et al., 2023; Wang et al., 2024b; Yoon et al., 2024; Jain et al., 2024; Lee et al., 2025b;a), but they are fragile in open-source settings.
contrast, the
Null-space constraints. The null space of matrix, fundamental concept in linear algebra, refers to the set of all vectors that the matrix maps to the zero vector. The null-space constraints are first applied to continual learning by projecting gradients onto the null space of uncentered covariances from previous tasks (Wang et al., 2021). Subsequent studies (Lu et al., 2024b; Wang et al., 2024a; Yang et al., 2024a; Kong al., 2022: Lin et al.. 2022) further explore and extend the application of null space in continual learning. In model editing. AlphaEdit (Fang et al., 2024) restricts model weight updates onto the null space of preserved knowledge, effectively mitigating trade-offs be- tween editing and preservation. Null-space constraints also apply to various tasks, e.g., machine unlearning (Chen et al., 2024), MRI reconstruction (Feng et al., 2023), and image restoration (Wang et al., 2022), offering promise for editing-based concept erasure.
3 PROBLEM FORMULATION
In T2I diffusion models, each concept is encoded by a set of text tokens via CLIP (Radford et al., 2021), which are then aggregated into single concept embedding there are two sets of concepts: the erasure set E and the retain set R. The erasure set consists of N target concepts to be removed, denoted as E Nx The retain set includes Nn non-target concepts that should be preserved during editing, denoted as R = ()) Nn. To enable efficient crasure efficacy for E and prior preservation for R, we first formulate closed-form editing objective in Sec. 3.1, and enhance it with null-space constrained optimization in Sec. 3.2.
Rdo For concept erasure,
)==1-
3.1 CONCEPT ERASURE IN CLOSED-FORM SOLUTION
To effectively erase each target concept cl E E (e.g., Snoopy), it is specified to be mapped onto an anchor concept ( that shares general semantics (e.g., Dog), termed an anchor set
3

---

Published as a conference paper at ICLR 2026
A (c!") Ji=1- For editing-based methods (Orgad et al., 2023; Gandikota al., 2024; Gong al., 2025), concept embeddings from the erasure set E, anchor set A, and retain set R. are first organized into three structured matrices: C1. C, RdoxNE and Co E RdoxNa, representing the stacked em- beddings of target, anchor, and non- con-target concepts, respectively. To derive a closed-form solution for concept erasure, existing methods typically optimize perturbation A to model parameters W, balancing between erasure efficacy and prior preservation. For example, UCE (Gandikota et al., 2024) formulates concept erasure weighted least squares problem:
UCE = arg min [(W + AjC, WC.|
|
(I)
where the erasure error 61 ensures that each target concept is mapped onto its corresponding anchor concept and the preservation error eo minimizes the impact on non-target concepts, and ||- denotes the sum of the squared elements in the matrix (i.e. Frobenius norm). This formulation provides a closed-form solution AUCE (see Appx. B.1) for parameter updates, achieving computationally effi- cient optimization. However, as the number of target concepts increases, the accumulated preser- vation errors cg, which admit a provable non-zero bound (see Appx. B.2), across multiple target concepts would amplify the impact on non-target knowledge and degrade prior preservation.
3.2 APPLY NULL--PPACE CONSTRAINTS
To address the limitation of weighted optimization in prior preservation, SPEED incorporates null- space constraints (Wang et al., 2021; Fang et al., 2024) to achieve prior-preserved model editing by forcing co = 0. The null space of Co consists of all vectors v such that vC. = O. Restricting the parameter update A to this space ensures that such updates do not interfere with non-target concepts.
To project A onto null space, we apply singular value decomposition (SVD) on C E Rdoxdo and have {U, A, UT} C, and A is a diagonal matrix of its singular values. The singular vectors in U w.r.t. zero singular values form an orthonormal basis for the null space of Co, which we denote as Ü. Using this basis, we construct the null-space projection matrix P = ÜÙT This process is formulated as:
SVD (CoCo) ), where U Rd contains the singular vectors of
(U.A. SVD (CoC.). Ú U A. = 0], P-ŪU.
The final update applied to model parameters is AP, which projects A onto the null space of Co- This ensures that updates do not interfere with non-target concepts, satisfying ||lPP)Coll 0. To solve for the updates, we minimize the following objective:
Null
arg min (W + - - WC.1 + (AT)
AP
(3)
regularization
where | is regularization term to ensure convergence. The preservation term || [(PP) 1 is omitted, as it is guaranteed to be zero by the null-space constraint (Co = 0). This objective allows the model parameters to be updated such that target concepts are effectively erased while representations of non-target concepts remain unaffected, thereby achieving prior-preserved concept erasure.
4 PRIOR KNOWLEDGE REFINEMENT
However, as more diverse non-target concepts are included in the retain set, the rank of the correla- tion matrix C. CJ gradually i The null space, defined as the orthogonal complement of this span, correspondingly shrinks in dimension:
dim(Null (CoC)) do rank CC
(4)
Here, the null space dimension characterizes the degrees of freedom available for editing without affecting the non-target concepts. However, as this dimension shrinks, ensure sufficient degrees of
CC and Co share the same null space. We operate C. do since it has fixed row dimension while Co E No may have high dimensionality depending on concept number Nu- We assume that the concepts not exactly linearly dependent in the representation space, which is gen- erally satisfied in practice due to the semantic diversity and high dimensionality of the embedding space.
4

---

Published as a conference paper at ICLR 2026
freedom for concept erasure, we compelled to include additional singular vectors w.r.. non-zero singular values in Ü following (Fang al., 2024), which leads to an approximate null space and induces semantic degradation (see Fig. 2). To improve, we propose Prior Knowledge Refinement, structured strategy for refining the retain set to enable accurate null-space construction, with three complementary techniques: (1) Influence-Based Prior Filtering (Sec. 4.1) to discard weakly affected non-target concepts to form viable null space; (2) Directed Prior Augmentation (Sec. 4.2) to ex- pand the retain set with targeted and semantically consistent variations; and (3) Invariant Equality Constraints (Sec. 4.3) to enforce equality constraints to preserve critical invariants during generation.
4.1 INFLUENCE- BAAEE PRIOR FILTERING (IPF)
Given a predefined retain set, existing editing- based methods (Gandikota et al., 2024; Gong et al., 2025) treat all non-target concepts equally when enforcing prior preservation. However, an over- looked fact is that parameter updates inherently induce output changes over non-target concepts, and these changes vary across different non-targer concepts. This suggests that not non-target concepts contribute equally to preserving prior knowledge, and weakly influenced concepts offer ponatoaaaaan little benefit but introduce additional ranks that narrow the null space.
To this end, we propose explicit and model-consistent metric (i... prior shift) to quantify how much a certain non-target concept is affected by concept erasure. Specifically, we isolate the effect of erasure by solving for closed-form update A erae that minimizes only the erasure emror e1 while discarding the preservation term 6o from Eq. 1:
A crase
arg min
(W + C WC,
|
c,C -CCC CL
A
regularization
(5) where ||||| is introduced for convergence. For each non-target concept embedding co, define its prior shift as eolee This value offers a faithful reflection of how parameter updates perturb non-target concept in the feature space with closed form computation, and can naturally generalize to assessing multi-concept erasure effects. Based on this, we filter the original retain set R. to focus only on highly influenced concepts:
R R + (co R e 2 #J:
(6)
where the mean value p EEg--
-R R [I| erase Co || serves filtering threshold.
4.2 DIRECTED PRIOR AUGMENTATION (DPA)
To further enhance the prior preservation with broader retain coverage, an intuitive strategy is to augment the retain set by perturbing non- target embedding Co with random noise (Lyu et al., 2024). However, this strategy would introduce meaningless embeddings that fail to generate semantically coherent images (e.g. noise image), resulting in excessive preserva- tion with increasing ranks. To search for more semantically consistent concepts, we introduce directed noise by projecting the random noise onto the direction in which the model parame- ters W exhibit minimal variation. This opera- tion ensures the perturbed embeddings express closer semantics to the original concept after being mapped by W (see Fig. 3). Specifically, we first derive projection matrix P m
Original Concept
w/ Random Noise
w/ Directed Noise (Qurs)
(a) Concept Embedoing Space
(b) Key/Value Space
Figure 3: t-SNE distribution of perturbing the original concept with random noise and directed noise. (a) Similar to random noise, our method can span a broad concept embedding space. (b) Our directed noise preserves semantic similarity to the original concept with closer distances in the space mapped by W.
(Uw, ) = SVD (W), Pmin Umin U
min!
where Umi Uwl: -r denotes the singular vectors w.r.t. the smallest r singular v which represent the r least-changing directions of W and constrain the rank of the augmented embeddings
Empirically, the model parameter matrix W usually full rank, thus its all singular values non-zero.
5

---

Published as a conference paper at ICLR 2026
Prampt: "A painting of Snoopy"
Prompt
Original:
Prompt:
"A cartzon Miskey"
"A Hello Kity in vidro game"
Target Concepts
RECE
MACE
RECE
-Miskay
_Soooppe
-Epangsdiite
Figure 4: Qualitative comparison of the few-concept erasure in erasing instances. The erased and preserved generations are highlighted with red and green boxes, respectively, Our method exhibits consistent prior preservation with less semantic degradation for non-target concepts. For example, the middle column better retains details such as Mickey's ' hat and button count, and the right column demonstrates more consistent Hello Kitty generations along with three concepts erased.
maximum of Then the directed noise P min used perturb the original embedding via:
6 co + e P Pmin+
e e~ (O,1I.
(8)
Given a retain set R, the augmentation process can formulated as follows:
RS R
U (co + C.
Pminn| k = 1k.....,NAll NA),
(9)
where Na denotes the augmentation times and + Ex P Pmin represents the k-th augmented embed- ding given Co E R using Eq. 8. In implementation, we first apply IPF to the original retain set R to obtain R,, and then apply DPA followed by IPF to R, produce (Ry) m as augmented concepts.
Finally, we combine them to serve as the final refined retain set Ryetine = R2 U (R,)
4.3 INVARIANT EQUALITY CONSTRAINTS (IEC)
In parallel, identify certain invariants during the T2I generation process, i.e., intermediate vari- ables that remain unchanged under different sampling prompts. One such invariant is the CLIP- encoded [SOT] token. Since the encoding process is masked by causal attention and all prompts are prefixed with the fixed [SOT] token during tokenization, its embedding consistently remains unchanged during T2I process. Another invariant is the null-text embedding.
corresponds the unconditional generation under the glassifier-free guidance (Ho & Salimans, 2022), which also re- mains unchanged despite prompt variations. Given the invariance these embeddings, we consider additional preservation measures to ensure their outputs remain unchanged during concept erasure. Specifically, we introduce explicit equality constraints over invariants based on Eq. 3:
min [(W + AP)C; WC,|12+
|AP||
(AP)C² =0
(10)
regularization
equality
where C2 stacks the invariant embeddings of [SOT] and null-text. Using the projection matrix P constructed from Ryeine derive the closed-form solution of Eq. 10 using Lagrange Multipli- ers from Appx. B.3:
(AP) Ours = W (C.C, - C,C, PQM,
(11)
where
M = (C QQ= ---0-MM, MC,
C.P.
(12)
This closed-form solution enforces the equality constraints by projecting the parameter update onto the subspace orthogonal to the invariant embeddings. Since image generation inevitably depends on these invariant embeddings, such constraints inherently preserve prior knowledge.

---

Published as a conference paper at ICLR 2026
Table 1: Quantitative comparison of the few-concept erasure on instances (left) and artistic styles (right), where target concepts are highlighted in pink. Arrows indicate the preferred direction for each metric, and the best results are highlighted in bold. Our method consistently improves prior preservation non-target and general concepts from MS-COCO while achieving effective concept erasure. Although our CS is not always the lowest for target concepts, Appx. D.I shows our method is sufficient for erasure, and lower CS may further compromise prior preservation.
Concept
Snoepy
Michey
SpongeheB
Pikacha
Hollo Kltyy
MS-COCO
Via Gogh
Pieass
Monel
Paul Gaugaii
Conooggle
MS-00CO
C8
C35
CS
CS
CS
CS
HD
C5
C5
C5
CS
C5
C5
FTD
SD
28:1
25.62
27.30
27
17.44
27.77
26.53
510
v1.4
26:75
27.88
38.1
29.60
26.27
26.85
Eriee Snoopy
Eru Vin Gogk
C8.
HDD
FID
FRD
PBD
[8.
C3.
FID
FID ]
EID
[3T
CosAMl
25.44
37.88
36.50
36.40
28.16
63.50
79.35
MACE
20.90
135.97
102:77
63.71
36.09
42.02
25.86
60.58
56.18
69.04
36.50
23.15
RFCE
18.38
93
36.19
68.97
61.09
47:00
77.81
76.93
71.81
UCE
25:19
2457
29.86
19.06
27.86
36-46
22.18
UCE
28.10
43.02
40.49
32.63
61.72
26.54
19.03
23.50
2341
21.74
36.45
19.95
16.55
24.94
39.75
36.55
Stoapy Mickey
FID
FID
CoRANi
25.25
25.58
41. 0444
24.34
26.23
79.12
26.43
20:53
3063
91.72
106.88
15.90
17.02
66.30
36.47
18.57
26.05
40.77
75.09
34.79
16.22
23.55
23.62
28:23
13,66
10.97
Snorgy Mickey Spongehho
Iinaz Munal
CS
CS
FED 1
FED
CS
FID
FID
FID
CS.
F1D
FID
CST
FID
CrEAM
25,46
15.17
66.47
48 24
36.37
26.71
ConAh1
68:77
64.25
17.06
57.33
71.81
36.45
21:03
MACE
19.86
19:35
20.12
110.12
125.56
23.39
66.39
MACE
$1.50
48.41
25.98
49.56
65.37
36.47
22.76
RECE:
18.17
18,87
16.21
40.52
$2.06
36.32
12.51
96.25
45:97
35.87
64.19
36.49
34.94
UCE
23.29
24.33
19.08
29.20
36:15
36.30
26.71
UCB
41.25
36.73
27.12
13.00
58.40
36.51
21.58
Ous
23,89
23.88
21.39
21.49
26.22
36.51
24.99
Ous
26.78
41.31
25.06
27.85
35.20
36.48
20:87
5 EXPERIMENTS
In this section, we conduct extensive experiments on three representative erasure tasks, including few-concept erasure, multi-concept erasure, and implicit concept erasure (Appx. D.4), validating our superior prior preservation. The compared baselines include ConAbl (Kumari et al., 2023), MACE (Lu et al., 2024a), RECE (Gong et al., 2025), and UCE (Gandikota et al., 2024), which have achieved SOTA performance across various concept erasure tasks, In implementation, we conduct all experiments on SDv1.4 (Stability AI, 2022) and generate each image using DPM-solver sampler (Lu et al., 2022) over 20 sampling steps with classifier-free guidance (Ho & Salimans, 2022) of 7.5. More implementation details and compared baselines can be found in Appx. Cadd Appx. D.3.
5.1 ON FEW-CONCEPT ERASURE
Evaluation setup. We evaluate few-concept erasure on instance erasure and artistic style erasure following (Lyu al., 2024), using 80 instance templates and 30 artistic style templates with 10 images per template per concept. We use two metrics for evaluation: CLIP Score (CS) (Radford al., 2021) for the text-image similarity and Fréchet Inception Distance (FII) (Heusel et al., 2017) for the distributional distance before and after erasure. Following (Lyu et al., 2024), we select non- target concepts with similar semantics to the target concept for comparison and report CS for targets and FID for non-targets in the main paper. Complete comparisons are presented in Appx. D.2. We further compare the generations on MS-COCO captions (Lin al., 2014), where we generate images with the first 1,000 captions, and report CS and FID to measure general knowledge preservation.
Analysis and discussion. Table 1 compares the results of erasing various instance concepts and artistic styles. Our method consistently achieves the lowest FIDs across all non-targ non-target concepts, demonstrating superior prior preservation with minimal alteration the original content. Moreover, we emphasize that our erasure is sufficiently effective, even without achieving the lowest CS, as shown in Figs. 4 and 7, On this basis, lower CS values typically indicate "over-erasure" of the target concept, since further reductions in CS after successful erasure usually come at the cost of prior preservation, as detailed in Appx. D.I. Notably, with the number of target concepts increasing from I to 3. our FID in Pikachu rises from 16.81 to 21.40 (4.59 1), while UCE increases from 19.06 to 29.20 (10. 14 t). A similar pattern is observed in Hello Kitty (Our 4.48 v.s. UCE's 10.29 f), showing our superiority of prior preservation in erasing increasing target concepts.
7

---

Published as a conference paper at ICLR 2026
Table 2: Quantitative comparison of the multi-concept erasure in erasing 10, 50, and 100 celebri- ties. The best results are highlighted in bold, Our method can effectively erase up to 100 celebrities simultaneously. achieving low Acce (%) and high Ace, (%) that preserve non-targed celebrities with minimal appearance changes. This yields the best overall erasure performance Ho and competitive runtime (8), successfully erasing 100 concepts in just 5 seconds.
Fraee Celebrities
MS-00CO
Brase Colebrities
MS-C000
Brase 100 Celebrities
MS-0DCO
Acc.
Ace,
H Tine
CS T
FID
Asc, 1
Acc:
H.
Tise
CS
FID
AARy J
Acc.
H,
Time
CS1
FID 1
91.99
89.00
14.70
26:33
V3.08
19.06
12.85
26.53
90:18
39.60
17:70
26.33
ConAM
60.76
77.80
52.19
900
25.60
42.12
64.00
75,44
48.74
4,500
14.30
255.36
42.86
58.82
$7.97
9.000
14.53
235.27
UCR
RECE
0.34
67.43
80.44
255
16.75
170.65
1.03
19.77
32.95
6.3
13.09
213.39
2,43
23.71
35.16
11.0
12.09
177.57
MAUB
1.62
87:73
92.75
207
26.36
37.25
3,40
64.31
90003
916
25.05
05.31
4.50
81.20
87.00
1736
24,00
50.41
Oun
1.31
89.00
03.42
3.8
36.47
30,02
3.45
88.48
92.34
4.2
26.46
39.23
5.87
85.54
89.63
5.0
26.32
44,97
5.2 ON MULTI-CONCEPT ERASURE
Evaluation setup. Another more realistic erasure scenario is multi-concept erasure, where massive concepts are required to be erased at once. We follow the experiment setup in Lu et al. (2024a) for erasing multiple celebrities, where we experiment with erasing 10, 50, and 100 celebrities and collect another 100 celebrities as non-target concepts. Specifically, we prepare 5 prompt templates for each celebrity concept. For non-target concepts, we generate image per template for each of the 100 concepts, totaling 500 images. For target concepts, we adjust the per-concept quantity to maintain total of 500 images (e.g., erasing 10 celebrities involves generating 10 images with templates per concept). In evaluation, we adopt GIPHY Celebrity Detector (GCD) (Hasty et al., 2019) and measure the top-1 GCD accuracy, indicated by Acc, for erased target concepts and Acc, for retained non-target concepts. Meanwhile, the harmonic mean Ho (1-Ace.) +(Ace,) is adopted to assess the overall erasure performance. Additionally, we report the results on MS-COCO to demonstrate the prior preservation of general concepts.
Analysis and discussion. Table 2 showcases notable improvement of our method multi- concept erasure, particularly in prior preserva- tion with the highest Acc,.. In comparison with the SOTA method, MACE (Lu et al., 2024a), our method achieves superior prior preserva- tion with better Acc,, while maintaining com- parable erasure efficacy, as reflected in similar Acc.. resulting in the best overall erasure per- formance indicated by the highest H,, Mean- while, our method attains the lowest FID across all methods on MS-COCO, The other methods, UCE (Gandikota et al., 2024) and RECE (Gong et al., 2025), although achieving considerable balance in few-concept erasure, fail to maintain this balance as the number of target concepts increases shown in Fig. 5, with catastrophic prior damage evidenced by MS-COCO as well. No- tably, our method can erase up to 100 celebrities in 5 seconds, whereas MACE requires around 30 minutes (x350 time). In real-world scenarios, this efficiency underscores our potential for the instant erasure of massive concepts,
Prompt: portralt of Andreww Garfleid" portrait Juuy
Original:
UCE
RECE
Ours
-owlob-
400
Figure 5: Quantitative comparison of the multi- concept erasure in erasing celebrities (celeb). The erased and preserved generations are marked with red and green boxes. Our method precisely crases 100 celebrities while preserving genera- tions of other non-target concepts.
5.3 FURTHER ANALYSIS
More applications on other T2I models. To validate the transferability of our method across ver- satile applications, we conduct further experiments on various T2I models with different weights and architectures, including: (I) Composite concept erasure on DreamShaper (Lykon, 2023) and Realistic (SG161222, 2023) from Fig 6 (a): Our method can precisely erase the target con- cept(s) while preserving other non-target elements within the prompt, such as the Van Gogh-style background (2nd column) and the Snoopy character (3rd column). (2) Knowledge editing SDXL (Podell et al., 2023) from Fig 6 (b): The arbitrary nature of anchor concepts allows us to edit the pre-trained model knowledge. Herein, our method effectively edits the model knowledge while
8

---

Published as a conference paper at ICLR 2026
Original
-Sroppy
~Vonr-Bggfm
-Broppy & &-Ven-Gagh
Original
(a) Compusite Concept Erusure un Community Versions
(c) Instance Erasure (Ist row) and Prior Preservation (2nd row) on SDv3
-Wonder-Woman-
Woman
-Sppermann
Batman
Knowledge Editing (eg. "Wonder Woman Womtnn" and "Superman Batman") SDXL
Figure 6: More applications across various T2I diffusion models. (a) We conduct composite concept erasure for "Snoopy + Van Gogh" on DreamShaper (Lykon, 2023) (1st row) and Realis- tie Visiin (SG161222, 2023) (2nd row). (b) Our method also enables model knowledge editing by specifying the anchor concept SDXL (Podell et al., 2023). (c) Our method can seamlessly trans- fer to novel DiT-based T2I models, e.g., SDv3 (Esser et al., 2024).
maintaining the overall layout and semantics of the generated images. (3) Instance erasure SDv3 (Esser et al., 2024) from Fig 6 (c): To accommodate the diffusion transformer (DiT) (Peebles & Xie, 2023) architecture in T21 models, adapt our method to DiT-based model, demonstrating well-balanced trade-off between erasure (Ist row) and preservation (2nd row) as well.
Component ablation. From Table 3, we com- pare the individual impact of our components on prior preservation and draw the following conclusions: (1) Impact of IEC (Ablation v.s. 2): IEC reduces the non-target FID and the MS- COCO FID, demonstrating its effectiveness by preserving invariant embeddings with equality constraints. (2) Impact of IPF (Ablation 2 v.s. 3): Incorporating IPF results in a significant im- provement in both FIDs, underscoring its criti- cal role in filtering out less- influunnffeeeddd concepts in the retain tion. (3) Impact of DPA (Ablation 4 v.s. Ours): DPA improves RPA with directed noise and leads to substantial improvement in non non-target and MS-COCO FIDs, highlighting its advan- tage by introducing semantically similar con- cepts into the refined retain set. conclude, the proposed three components (i.e, IEC, IPF, and DPA) improve the prior preservation from different perspectives and contribute to our method with best prior preservation under null space constraints. More ablations are presented in Appx. D.5.
Table Ablation study on proposed components in erasing Van Gogh, with the non-target FID av- eraged over the other four artistic styles from Ta- ble 1. Ablation corresponds to the original ob- jective from (Fang al., 2024) in Eq. 3. The ab- lated components include: IEC (Invariant Equal- ity Constraints), IPF (Influence-bar based Prior Fil- tering), RPA (Random Prior Augmentation), and DPA (Directed Prior Augmentation).
Components
Target
Non-Target
MS-COCO
Abiaton
IEC
IPF
DRA
CS1
mitigate semantic degrada-
27.20
50.43
26.42
2
27.30
48.17
26.44
34.95
26.68
26.54
26.30
32.62
26.52
20.99
SD
28.35
26.53
CONCLUSION
This paper introduced SPEED, scalable, precise, and efficient concept erasure method for T2I diffusion models. It formulates concept erasure as a null-space constrained optimization problem, facilitating effective prior preservation along with precise erasure efficacy. Critically, SPEED over- comes the inefficacy of editing-based methods in multi-concept erasure while circumventing the prohibitive computational costs associated with training- based approaches. With our proposed Prior Knowledge Refinement involving three complementary techniques, SPEED not only ensures supe- rior prior preservation but also achieves 350x acceleration in multi-concept erasure, establishing itself as scalable and practical solution for real-world applications.

---

Published as a conference paper at ICLR 2026
ETHICS STATEMENT
This work introduces a method for concept erasure in text-to-image diffusion models to address ethical concerns such as copyright infringement, privacy violations, and the generation of offensive content. By precisely removing specific target concepts while preserving the quality and seman- ties of non-target outputs, the proposed approach enhances the safety, reliability, and controllability of generative models. The method operates through parameter-space editing without requiring ac- cess to private data or involving human subjects, ensuring ethical integrity throughout the research process and promoting responsible deployment of generative AI technologies.
REFERENCES
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, lige Akkaya, Florencia Leoni Ale- man, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, al. Gpt-4 technical report. arXiv preprint arXiv:2303, 08774, 2023.
Amazon. Amazon Mechanical Turk: Crowdsourcing Marketplace. https: https://www.ttuzz www.k.tuukk.. com/.
Bedapudi.. Nudenet: Neural nets for nudity classification, detection and selective censoring, 2019.
James Betker, Gabriel Goh, Li Jing, Tim Brooks, Jianfeng Wang, Linjie Li, Long Ouyang, Juntang Zhuang. Joyce Lee, Yufei Guo, et al. Improving image generation with better captions. Computer Science. https://edn. openai. com/papers/dalle--. pdf. 2(3):8, 2023.
Nicolas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle. Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In 32nd USENIX Security Symposium (USENIX Security 23). pp. 5253-5270, 2023.
Huiqiang Chen, Tianqing Zhu, Xin Yu, and Wanlei Zhou. Machine unleariing via null space cali- bration. arXiv preprint 1xXiv:2444413558 2024.
Yingqian Cui, Jie Ren, Han Xu, Pengfei He, Hui Liu, Lichao Sun, Yue Xing, and Jiliang Tang. Diffusionshield: watermark for copyright protection against generative diffusion models. arXiv preprint arXiv:23066 244444220 2023.
Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans image synthesis. Advances in neural information processing systems, 04:8780-8794, 2021.
Patrick Esser, Robin Rombach, and Bjorn Ommer. Taming transformers for high-resolution image synthesis. In Proceedings of the IEEE/CVF conference computer vision and pultern recogni- lion, pp. 12873-12883, 2021.
Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, et al. Scaling rectified flow transformers for high-resolution image synthesis. In Forty-first International Conference on Machine Learning, 2024.
Junfeng Fang, Houcheng Jiang, Kun Wang, Yunshan Ma, Xiang Wang. Xiangnan He, and Tat-seng Chua. Alphaedit: Null-space constrained knowledge editing for language models. arXiv preprint arXiv:2410.02355. 2024.
Chun-Mei Feng, Bangjun Li, Xinxing Xu, Yong Liu, Huazhu Fu, and Wangmeng Zuo. Learning federated visual prompt in null space for mri reconstruction. Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 8064-8073, 2023.
Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit H Bermano, Gal Chechik, and Daniel Cohen-Or. An image is worth one word: Personalizing text-to-image generation using textual inversion. arXiv preprint arXiv:2208. 01618, 2022.
Rohit Gandikota, Joanna Materzynska, Jaden Fiotto- natto-Kaufmmn, and David Bau. Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 2426-242222222 2436, 2023.
10

---

Published as a conference paper at ICLR 2026
Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzyúska, and David Bau. Unified concept editing in diffusion models. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pp. 5111-5120 2024.
Chao Gong, Kai Chen, Zhipeng Wei, Jingjing Chen, and Yu-Gang Jiang. Reliable and efficient concept erasure of text-to-image diffusion models. In European Conference Computer Vision, pp. 73-88. Springer, 2025.
Nick Hasty, lhor Kroosh, Dmitry Voitekh, and Dmytro Korduban. Giphy celebrity detector. https: / //github... com/ piyyy//////
2019.
Amir Hertz, Ron Mokady, Jay Tenenbaum, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. Prompt-to-prompt image editing with cross attention control. arXiv preprint arXiv:2208.01626, 2022.
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge local nash equilibrium. Advances in neural information processing systems, 30, 2017.
Jonathan Ho and Tim Salimans. arXiv:2207. 12598. 2022.
Classifier-free diffusion guidance.
arXiv preprint
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-6851, 2020.
Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. arXiv preprint 1eXiv:2106009685 2021.
Chi-Pin Huang, Kai-Po Chang, Chung-Ting Tsai, Yung-Hsuan Lai, Fu-En Yang. and Yu- Chiang Frank Wang. Receler: Reliable concept crasing of text-to-image diffusion models via lightweight erasers. In European Conference on Computer Vision, pp. 360-376. Springer, 2024.
Anubhav Jain, Yuya Kobayashi, Takashi Shibuya, Yuhta Takida, Nasir Memon, Julian Togelius, and Yuki Mitsufuji. Trasce: Trajectory steering for concept erasure. arXiv preprint arXiv:24/2.0765: 2024.
Changhoon Kim, Kyle Min, and Yezhou Yang. Race: Robust adversarial concept erasure for se- cure text-to-image diffusion model. In European Conference Computer Vision, pp. 461-478. Springer, 2024.
Diederik Kingma, Tim Salimans, Ben Poole, and Jonathan Ho. Variational diffusion models. Ad- vances neural information processing systems, 34:21666-21777, 2021.
Yajing Kong, Liu Liu, Zhen Wang, and Dacheng Tao. Balancing stability and plasticity through advanced null space in continual learning. In European Conference on Computer Vision, pp. 219-236. Springer, 2022.
Nupur Kumari, Bingliang Zhang, Sheng- Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Ye Yan Zhu. Ablating concepts in text-to-image diffusion models. In Proceedings of the IEFF/CVF International Conference Computer Vision, pp. 22691-22700 2023.
Byung Hyun Lee, Sungjin Lim, and Se Young Chun. Localized concept erasure for text-to-imaae diffusion models using training-free gated low-rank adaptation. In Proceedings of the Computer Vision and Pattern Recognition Conference, pp. 18596-18606. 2025a.
Byung Hyun Lee, Sungjin Lim, Seunggyu Lee, Dong Un Kang, and Se Young Chun. Concept pinpoint eraser for text-to-image diffusion models via residual attention gate. arXiv preprint trXiv:2506.22800 2025b.
Ouxiang Li, Yuan Wang, Xinting Hu, Huijuan Huang. Rui Chen, Jiarong Ou, Xin Tao, Pengfei Wan, Xiaojuan Qi, and Fuli Feng. Easier painting than thinking: Can text-to-image models set the stage, but not direct the play? arXiv preprint 16X 2025.

---

Published as a conference paper at ICLR 2026
Guoliang Lin, Hanlu Chu, and Hanjiang Lai. Towards better plasticity off in incre- mental learning: A simple linear connector. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 89-98, 2022.
Tsung- Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects context. In Computer Vision-ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part 13, pp. 740-755. Springer, 2014.
Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps. Advances in Neural Information Processing Systems, 35:5775-577 -7777, 2022.
Shilin Lu, Zilan Wang, Leyang Li, Yanzhu Liu, and Adams Wai-Kin Kong, Mace: Mass concept erasure in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 6430 6440, 2024a.
Yue Lu, Shizhou Zhang, De Cheng, Yinghui Xing, Nannan Wang, Peng Wang, and Yanning Zhang. Visual prompt tuning in null space for continual learning. arXiv preprint arXiv:2406.05656 2024b.
Lykon.
Dreamshaper v8 model card. dreamshaper- 8, 2023.
https://uuggiggffcc.cc cot
Mengyao Lyu, Yuhong Yang, Haiwen Hong, Hui Chen, Xuan Jin, Yuan He, Hui Xue, Jungong Han, and Guiguang Ding. One-dimensional adapter to rule them all: Concepts diffusion models and erasing applications. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 7559-7568 2024.
Alexander Quinn Nichol and Prafulla Dhariwal. Improved denoising diffusion probabilistic models. In International conference on machine learning, pp. 8162-811 -171. PMLR, 2021.
OpenAl. OpenAI: Introducing ChatGPT, 2022.
URL https://openas cotpnalg..cmmoool/////o
chatgpt.
Hadas Orgad, Bahjat Kawar, and Yonatan Belinkov. Editing implicit assumptions in text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 7053-7061, 2023.
William Peebles and Saining Xie. Scalable diffusion models with transformers. In Proceedings of the IEEF/CVF International Conference on Computer Vision, pp. 4105-4205, 2023.
Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhom, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXiv:2307.01152, 2023.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, al. Learning transferable visual models from natural language supervision. In International conference on machine learning. pp- 8748-8763, PMLR, 2021.
Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alec Radford, Mark Chen, and Ilya Sutskever. Zero-shot text-to-image generation. In International conference on machine learning, pp. 8821-8831. Pmlr, 2021.
Javier Rando, Daniel Paleka, David Lindner, Lennart Heim, and Florian Tramèr. Red-teaming the stable diffusion safety filter. arXiv preprint urXiv:2210.0461 04610, 2022.
Dana Rao. URL
Responsible innovation in the age of generative ai. 2023. https://bloq.adooe com/ en wttpc/////p/..sss/////////////// htw.://ssheeeeooaaaooooaao------
12

---

Published as a conference paper at ICLR 2026
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- on computer vision and pattern recognition, pp. 10684-10695, 2022.
Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfrr Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In Pro- ceedings of the IEEF/CVF conference on computer vision and pattern recognition, pp. 22500- 22510, 2023.
Patrick Schramowski, Manuel Brack, Bjöm Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.
2023.
Christoph Schuhmann, Richard Vencu, Romain Beaumont, Robert Kaczmarczyk, Clayton Mullis, Aarush Katta, Theo Coombes, Jenia Jitsev, and Aran Komatsuzaki, Laion-400m: Open dataset of clip-filterdd 400 million image-text pairs. arXiv preprint arXiv:2 1.02/ 2021.
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, al. Laion-5b: open large-scale dataset for training next generation image-text models. Advances in Neural Information Processing Systems, 22225527-22294,, 2022.
SG161222. Realistic vision v5.1 (novae) model card. https://hugginggfent (E161222/Realise
Vision V5 nOVAE, 2023.
Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y Zhao. Glaze: Protecting artists from style mimicry by [Text-tolmmage) models. In 32nd USENIX Security Symposium (USENIX Security 23), pp. 2187-2204, 2023.
Jascha Sohl-Dicksteni Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In International Conference on Machine Learn- ing. pp. 2256-2265. PMLR, 2015.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02500) 2020a.
Yang Song. Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011.13356 2020b.
Stability AI. Stable diffusion v1-4 model card. https:
stable-di wotddiffusii www.fuuss-iiiieeaaeeeeeeaaosaale 2022.
Yoad Tewel, Rinon Gal, Gal Chechik, and Yuval Atzmon. Key-locked rank one editing for text-to- image personalization. In ACM SIGGRAPH 2023 Conference Proceedings, pp. 1-11, 2023.
Yu-Lin Tsai, Chia-Yi Yi Hsu, Chulin Xie, Chih-Hsun Lin, You Chen, Bo Li, Pin- Yu Chen, Chia-Mu Yu, and Chun- Chun-Ying Huang. Ring-a-bell! how reliable are concept removal methods for diffusion models? arXiv preprint arXiv:23100 10012, 2023.
Aaron Van Den Oord, Oriol Vinyals, al. Neural discrete representation learning. Advances in neural information processing systems, 30, 2017.
Shipeng Wang, Xiaorong Li, Jian Sun, and Zongben Xu. Training networks in null space of feature covariance for continual learning. In Proceedings of the IEEE/CVF conference on Computer Vision and Pattern Recognition, pp. 184-193, 2021.
Shipeng Wang, Xiaorong Li, Jian Sun, and Zongben Xu. Training networks in null space of feature covariance with self-supervision for incremental learning, IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024a.
Yinhuai Wang, Jiwen Yu, and Jian Zhang. Zero-shot image restoration using denoising diffusion null-space model. arXiv preprint 22Xiv:2212.004:2 2022.
13

---

Published as a conference paper at ICLR 2026
Yuan Wang, Ouxiang Li, Tingting Mu, Yanbin Hao, Kuien Liu, Xiang Wang, and Xiangnan He. Precise, fast, and lowt concept erasure in value space: Orthogonal complement matters. arXiv preprint wxXh:2442.006133 2024b.
Yuan Wang, Borui Liao, Huijuan Huang, Jinda Lu, Ouxiang Li, Kuien Liu, Meng Wang, and Xiang Wang. Thinking with frames: Generative video distortion evaluation via frame reward model. arXiv preprint (Xi1:2601.040333 2026.
Zhicai Wang, Ouxiang Li, Tan Wang, Longhui Wei, Yanbin Hao, Xiang Wang, and Qi Tian. Prior preserved text-to-image personalization without image regularization. IEEE Trunsactions on Cir- cuits and Systems for Video Technology, 2024c.
Yongliang Wu, Shiji Zhou, Mingzhuo Yang, Lianzhe Wang, Heng Chang, Wenbo Zhu, Xinting Hu, Xiao Zhou, and Xu Yang. Unlearning concepts in diffusion model via concept domain correction and concept preserving gradient. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pp. 8496-8504, 2025a.
Yongliang Wu, Yizhou Zhou, Zhou Ziheng, Yingzhe Peng, Xinyu Ye, Xinting Hu, Wenbo Zhu, Lu Qi, Ming-Hsuan Yang, and Xu Yang. On the generalization of sft: A reinforcement learning perspective with reward rectification. arXiv preprint arXiv:2508.0500 2025b.
Yiyan Xu, Wenjie Wang, Yang Zhang, Biao Tang, Peng Yan, Fuli Feng, and Xiangnan He. Per- sonalized image generation with large multimodal models. In Proceedings of the ACM on Web Conference 2025, pp. 264-274, 2025a.
Yiyan Xu, Jinghao Zhang, Alireza Salemi, Xinting Hu, Wenjie Wang, Fuli Feng, Hamed Zamani, Xiangnan He, and Tat-Seng Chua. Personalized generation in large model era: A survey. In Pro- ceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 24607-24649, 2025b.
Shilin Yan, Ouxiang Li, Jiayin Cai, Yanbin Hao, Xiaolong Jiang, Yao Hu, and Weidi Xie. sanity check for ai- di-geenrrated image detection. arXiv preprint arXiv:2406. /9435, 2024.
Chengyi Yang, Mingda Dong, Xiaoyue Zhang, Jiayin Qi, and Aimin Zhou. Introducing common null space of gradients for gradient projection methods in continual learning. In Proceedings of the 32nd ACM International Conference on Multimedia, pp. 5489-5497, 2024a.
Ling Yang, Zhilong Zhang, Yang Song, Shenda Hong, Runsheng Xu, Yue Zhao, Wentao Zhang, Bin Cui, and Ming-Hsuan Yang. Diffusion models: comprehensive survey of methods and applications. ACM Computing Surveys, 56(4):1-39, 2023.
Yijun Yang, Ruiyuan Gao, Xiaosen Wang, Tsung- Yi Ho, Nan Xu, and Qiang Xu. Mma-diffusion: Multimodal attack on diffusion models. In Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition, pp. 7737-7746, 2024b.
Jaehong Yoon, Shoubin Yu, Vaidehi Patil, Huaxiu Yao, and Mohit Bansal. Safree: Training-free and adaptive guard for safe text-to-image and video generation. arXiv preprint arXiv:2410.12761, 2024.
Gong Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not Learn- ing to forget in text-to-image diffusion models. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1755-1764, 2024a.
Yimeng Zhang, Xin Chen, Jinghan Jia, Yihua Zhang, Chongyu Fan, Jiancheng Liu, Mingyi Hong, Ke Ding, and Sijia Liu. Defensive unlearning with adversarial training for robust concept era- sure in diffusion models. Advances in neural information processing systems, 37:36748-36776, 2024b.
Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yihua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. To generate not? safety-driven unleamed diffusion models are still easy to generate unsafe images... for now. In European Conference on Computer Vision, pp. 385-403. Springer, 2024c.
14

---

Published as a conference paper at ICLR 2026
Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yihua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. To generate or not? safety-driven unleamed diffusion models are still easy to generate unsafe images... for now. In European Conference Computer Vision, pp. 385-403. Springer, 2025.
Mengnan Zhao, Lihe Zhang, Xingyi Yang, Tianhang Zheng, and Baocai Yin. Advanchor: Enhancing diffusion model unlearning with adversarial anchors. arXiv preprint arXiv:2501.00053 2024a.
Mengnan Zhao, Lihe Zhang, Tianhang Zheng, Yuqiu Kong, and Baocai Yin. Separable multi- concept erasure from diffusion models. arXiv preprint 4xXi:2442.059447 2024b.
15

---

Published as a conference paper at ICLR 2026
A PRELIMINARIES
T21 diffusion models. T2I generation has seen significant advancements with diffusion models, particularly Latent Diffusion Models (LDMs) (Rombach et al., 2022). Unlike pixel-space diffusion, LDMs operate in the latent space of pretrained autoencoder, reducing computational costs while maintaining high-quality synthesis. LDMs consist of a vector custor-quanized autoencoder (Van Den Oord al., 2017: Esser et al., 2021) and a diffusion model (Dhariwal & Nichol, 2021; Ho et al., 2020; Sohl-Dickstein et al., 2015; Kingma et al., 2021; Song et al., 2020b; Wang et al., 2024c; 2026; Li al., 2025). The autoencoder encodes an image into latent representation 2 {(x) and recon- structs it via x D(z). The diffusion model learns to generate latent codes through a denoising process. The training objective is given by (Ho et al., 2020; Rombach et al., 2022):
[Ile [ (0(2),
LLDM
(13)
where 2₁ is the noisy latent at timestep I, is Gaussian noise, Eg is the denoising network, and e conditioning information from text, class labels, segmentation masks (Rombach et al., 2022). During inference, latent 2y is sampled from Gaussian prior and progressively denoised to obtain 2o, which is then decoded into an image via Do D(zo).
Cross-attention mechanisms. Current T2I diffusion models usually leverage a generative frame- work to synthesize images conditioned on textual descriptions the latent space (Rombach al., 2022). The conditioning mechanism is implemented through cross-attention (CA) layers. Specifi- cally, textual descriptions are first tokenized into tokens and embedded into sequence of vectors E Rdoxn via a pre-trained CLIP model (Radford et al., 2021). These text embeddings serve as the key K E Raxxx and value V E Randd inputs using parametric projection matrices WK Red x and Wv Xdo, while the intermediate image representations act the query Q mxx. The cross-attention mechanism defined as:
QK vdk
Attention K, V) = softmax
V.
(14)
This alignment enables the model capture semantic correlations between the textual input and the visual features, ensuring that the generated images are semantically consistent with the provided text prompts.
B PROOF AND DERIVATION
B.1 DERIVING THE CLOSED-FORM SOLUTION FOR UCE
From Eq. we are tasked with minimizing the following editing objective, where the hyperpa- rameters and correspond to the weights of the erasure 61 and the preservation error co, respectively:
min [all (W AJC WC. +
(15)
To derive the closed-form solution, we begin by computing the gradient of the objective function with respect to A. The gradient is given by:
(WC; - WC, + CT + C = 0.
(16)
Solving the resulting equation yields the closed-form solution for AUCE:
AUCE aW (c.C. -CC (aC,cT +GCT++9C,00 +,C.0,))
(17)
In practice, an additional identity matrix with hyperparameter is added to C + CC to ensure its invertibility. This modification results in the following closed-form solution for UCE:
Aucr oW (C.CI - C.C,) (aC,c] 3COC AT)
(18)
16

---

Published as a conference paper at ICLR 2026
B.2 PROOF OF THE LOWER BOUND OF eg FOR UCE
Herein, we aim to establish the existence of a strictly positive constant > 0 such that
6o = AAuEE = laW (C.C - C.C,) (aC1C) CJ + BC,C + +AI - 2 < 0. (19)
Assumption B.1. We assume that a, 3, + O. that W is full-rank matrix, and that Co is rank-deficient. Furthermore, we assume that
- #0.
Proof.
Define the matrix M as
= aC, + +
(20)
Since À > 0 and I is positive definite, it follows that M is strictly positive definite and therefore invertible.
Rewriting by defining B = -M- Co. we obtain
6o = |cW(C.T
(21)
Applying the singular value bound for matrix products, have
XY| 2 m (Y)
(22)
where miin (X) is the smallest singular value of X. Applying this inequality, obtain
WWC.C - C,C, BB| min min (C)] (CC
(23)
start with the singular value decomposition (SVD) the matrix C.C. C,C given by
C.C C UEV..
(24)
Here, U and V are orthogonal matrices, and
Σ diag(o 11 02 .r. Or............... ......0)
(25)
is a diagonal matrix containing the singular values 2 02 2 ... 2 or >> 0, followed by zeros.
Multiplying both sides by B, we obtain
(C.C - - B
(26)
Define the projection of B onto the subspace spanned by the right singular vectors
B proj V
(27)
Then, we can rewrite the expression as
(C.CT - -CC - UEBpao-
(28)
Taking norms on both sides and using the fact that orthogonal transformations preserve norms, get
[| C B = EB
(29)
Since Σ is diagonal matrix, its smallest nonzero singular value or provides lower bound:
Bpoll 2 o, Bpojjl
(30)
Next, we establish a lower bound for | |Brrjjll Given that V is composed of right singular vectors, there exists smallest non-zero singular value e₁ such that:
B proj
2 cı BB].
(31)
Combining these inequalities, we obtain
[
C2 C. B ar B Bprj]]
2 0
|B||
(32)
17

---

Published as a conference paper at ICLR 2026
Since M is positive definite, the standard norm inequality for an invertible matrix M, which states that for any matrix X,
| S |
(33)
Setting X M M we obtain
|MM Coll
[| M
(34)
Since MM = I, the left-hand side simplifies to ||Coll, yielding
||Coll S
M M Coll-
(35)
Dividing both sides by ||M], we obtain
M C 2
Coll.
(36)
[M]
Thus, it follows that
B|| |M
Coll
(37)
M
Combining the above results, we obtain
1
| - -C
min (W)
Call
(38)
M
Squaring both sides, we conclude that
co laW(C.c - B o (
/col2
(39)
[
Since all terms on the right-hand side are strictly positive by assumption, we establish the existence of positive lower bound > such that
60 2c>0 O.
(40)
This completes the proof.
B.3 DERIVING THE CLOSED-FORM SOLUTION FOR SPEED
From Eq. 10, we are tasked with minimizing the following editing objective:
min
|| + AP)C1 - WC. |NC.|'+||P/|?? s.t. (AP) =. A
(41)
This is weighted least squares problem subject to an equality constraint. To solve it, we first formulate the Lagrangian function, where the Lagrange multiplier:
A) = [[W + AP)C; - WC.|| + AP + T ((AP)C2).
(42)
We compute the gradient of the Lagrangian function Eq. 42 with respect to and set it to zero, yielding the following equation for A:
aL(A, A) 2 ((W AP)C; WC.) + 2APP ACC. AA
=0.
(43)
Given that the projection matrix P is derived from Ryetine using Eq. P is symmetric matrix (i.e., P = T and an idempotent matrix (i.e., p2 = -P), the above formulation can be simplified to:
AL(A,A) A
2 ((W + AP)C; - WC.) C. + 2AP + ACT 0.
(44)
Therefore, we can obtain the closed- form solution for AP from this equation:
AP =
(45)
18

---

Published as a conference paper at ICLR 2026
Table 4: Evaluation setup for multi-concept erasure. This dataset contains an crasure set with 100 celebrities and a retain set with another 100 celebrities. We experiment with erasing 10, 50, and 100 celebrities with the predefined target concepts and the entire retain set is utilized in all cases.
Group
Number
Anchor
Celebrity
Concept
'Adam Driver', 'Adriima Lima', 'Amber Heard', Adams' 'Andrew Garfield' "Angelina Jolie'.
pprsoon'
"Anjelica Huston", 'Anna Faris "Amaa Kendrick', 'Anne Nathowey"
Aaaam Driver Adtiana TJm0 "Amber Heard Amyy Adous Garbee AAgellon dalle
Huthoway', 'Aroold Schwaraenegerr' Barack Obama', : 'Beth Behrr,. 'Bill Clinton' 'Bob Dylan', 'Bob Marley', 'Bradley Cooper', 'Brace Willie', 'Bryan Cranston: "Cameron Diaz', "Chomning Taran', "Chartie Shoee' 'Charizz Theron', Hewsworlk,' "Chris Pine', 'Chuck Nurriz,, 'Courtoney vato', ; 'Drake', 'Drew Barrymore', "Divayne Johnson'. 'Ed Sheeran', 'Elon Murk', "Elvis Pres- ley.. "Emnna Stane", 'Frida Kahla'. "George Clooney. "Glemn Close', "Gwyyeth Paltrow", 'Hazrionn Ford" 'Hillary Clinton,, 'Hugh Juckman', 'Idris Elba",
AAjellia Huston', "Amna
'Ama Kendrick
'person'
Evans..
Gyfleobuul', 'Jomes Francu"" 'Jored Leto', "Joson Momoe', 'Jounifer Amiston', "Jennier Lawrence"
"Adam Driver", 'Adriuma Limu', "Amber Heard' "Amy Adomss "Andrew Gorlield' "Angelino Jolie, 'Anjelica Huston', 'Amna Faris'. 'Amm Kendrick',
Hathaway', 'Amoll Schwerzenegger" 'Barack Obama', 'Beth Behrr", 'Bill Clinton', 'Bob Dylan', 'Bob Marley,, 'Bradley Cooper'. 'Brace Willie; "Bryan Cransoon; "Comeron Diaz', "Chamiing Tanmn,, "Charfie Sheew", "Charlize Theron', Hemswortk"
Erasure
Set
'Demi 'Chuck Norriz,, 'Courteney vato'. 'Drake', 'Dreg Barrymore', 'Dwvayne Johnson, 'Ed Sheeran', 'Elon Murk'. "Elvis Pres- ley 'Emmn Stone', "Fride Kahio', 'George Clooney, "Glena Close", "Goyyeth Palnow", 'Hor- rison Ford', 'Hillary Clinton', 'Hugh Jackmun', 'ddris Elba', "Joke Gyllenhouf',
Evans',
Franco'. 'Javed Leto', 'Jason Momoa'. 'Jennifer Aniston", ; "Jennifor Lawrence'' "Jeanifer Lopez', 'Jeremy Renner 'Jessica Biel', "Jessloo Chastain". "John Oliver, 'Jobn Wayne', "Jahnay Depp', Inn- limnne Howgh'. "Justia Timberlake', 'Kute Bosworth' 'Kale Winstet', "Leunardo Dicupriv's got Robbie" 'Mariah Carey', "Melania Tramp' 'Moryl Streep', , "Mich lagger', 'Mila Kunis" "Milla lovovich' 'Morgan Freeman' 'Nick Jonas', 'Nicolas Cage', 'Nicole Kidman' "Octavia Spencor'. "Olvia Wilde'. 'Uprah Winfey', 'Poul Mccartey' : Hoffman' 'Reese Witherpoon'. 'Richard Gere', 'Ricky Gervais', 'Rihanme', 'Robin Williams' Romald Roagan'. 'Ryan Gosling'. 'Ryan Reynolds', "Shia Labeouf "Shiriey Tomple' "Spike Lee'. Ston Thereso
100
'person'
Wulker" "Peter Diokloge', 'Plilii Seymour
'Tom Cruixe' 'Tom Hunky', "Tom Hardy, "Tom Hiddleston" "Whoopi Goldberg', Zac Efrun', 'Zayn Mulik'
'Aaron Paul", 'Alec Buldwin'. 'Amanda Sexfried' 'Amy Pocbler', "Amy Schumer', 'Amy Wine- "Andy Samberg'. 'Aretha Franhlin', 'Avril Lavigne', "Azic Anzori. 'Barry Monilow', Aflock' 'Ben Suiller, 'Bonicio Del Toro', 'Bone Midler', 'Betty White', 'Bill Murray,, 'Bill Nye' 'Briner Spearr', 'Briitany Snow", 'Brace Lee", 'Burt Reynolds', Charles Manoon. "Christie Brink- ley' "Christina Hendricks', "Cliat Eazwoodd. "Countess Vaughn' DDakata Johnson' hoon', 'David Bowte', 'Dovid Tommant" 'Donite Richards', : 'Doris Day', 'D Dre 'Eltzabeth Tay- lor', 'Emma Roberty', "Frea Rogers'. "Gal Gudot", "George Bush", "Goorge Taket", "Gillion An- derson'. "Gordon Ramsey", 'Halie Berry', 'Harry
Stanton', 'Harry Styles', 'Hayley Alwell'. 'Heath Ledger'. 'Henry Caviil', "Jackie Chon', "Jada Pinkett Smith" "James Gamer, "Jason Statham', "Jell Bridges', 'Jendffer Counelty', 'Jenee Ackles', "Jim Morrison: 'Jinmy Cazter', 'Joun Rivers'. 'John Lennon'. "Johnny Cath', "Justin Bieber', 'Kaley Cuoco', 'Kare Upton'. "Keam Reever', "Kim long Un., 'Kissten Dunzr' "Krisen Samwart, 'Kryson Riterr 'Lana Del Rey", LLssle Jones', 'illy Collinr. "Lindsay La- Cuplon', "Moggie Gyllenhoul', 'Moll
Retuin
Set
10, 50, and 100
Hamm'. "July Garfand', "Juliame Moore'.
"Liv Tyler'. Meconaughey', "Meya Angeiou" 'Megan Fox. 'Mel Gibron', 'Melanie Griflith', ; "iichael Cera'. 'Michae! Ealy" 'Natolle Portman' 'Neil Degrasse Tyron', 'Maill Horan" 'Paricc Suewarr' 'Padl Rudd'" 'Puul Wesley', 'Pience Brasunn 'Prince', 'Queen Elizabeil", "Rachel Dratch", 'Rachel Meadams', 'Reba Meentire', 'Robert De Nire'
"Matt Smith: 'Mothew
Next, we differentiate the Lagrangian function in Eq. 42 with respect to A and set zero:
aC(A, A) = (AP)C, =0
(46)
0A
For simplicity, we define M = -C P + 1)
Then, we substitute the result of Eq. 45 into
Eq. 46 and obtain:
-WC.CTP-ACTPMCCC ACTP/MCC 0.
(47)
Solving this equation leads to:
1 5
A- - - PMC, PM
(48)
Substituting Eq. 48 back into Eq. 45, we have the closed-form solution of our objective:
(AP) SPEED = W(C.CT - C,C, PQM,
(49)
where Q = I MC, PMC, and M (C,C
19

---

Published as a conference paper at ICLR 2026
Original
-Snoopy
Original
Mickey
Original
-SpongeBob
(a) Instance Erasure
Original
-Ven-
Original
-Edverd--Mamot-
Original
(b) Artistic Style Erasure
Original
-Adam-Briverr
Original
-Addrioma-tiime
Original
(c) Celebrity Erasure
Original
-Nvelity
Original
-Wereitym
Original
Nerditty
(d) Implicit Concept Crasure
Figure 7: Qualitative demonstration of our erasure performance across (a) inslance erasure, (b) artistic style erasure. (c) celebrity erasure, and (d) implicit concept erasure. Our method achieves effective erasure efficacy across various scenarios while exhibiting superior prior preservation. The corresponding CS highlighted in blue, indicating that successful erasure can be achieved without pushing CS much lower, results demonstrate sufficient erasure at moderate level.
20

---

Published as a conference paper at ICLR 2026
C IMPLEMENTATION DETAILS
C.I EXPERIMENTAL SETUP DETAILS
Few-concept erasure. We first compare methods on few-concept erasure, a fundamental con- cept erasure task, including both instance erasure and artistic style erasure following (Lyu et al., 2024). For instance erasure, we prepare 80 instance templates proposed in CLIP (Radford et al., 2021), such as "a photo of the {Instance]", ", "a drawing of the {Instance]" ", and "a painting of the [Instance]" ". For artistic style erasure, we use ChatGPT (OpenAI, 2022; Achiam et al., 2023) to generate 30 artistic style templates, including "I "[Artistic] style painting of the night sky with bold strokes", "[Artistic) style landscape of rolling hills with dramatic brushwork" and "Sunrise scene in {Artistic) style, capturing the beauty of dawn". Following (Lyu al., 2024), we handpick the representative target and anchor concepts the erasure set (i.e., Snoopy, Mickey, Spongebob + in instance erasure and Van Gogh, Picasso, Monet + 'art' in artistic style erasure) and non- target concepts for evaluation (i.e., Pikachu and Hello Kitty in instance erasure and Paul Gauguin and Caravaggio in artistic style erasure). In terms of the retain set, for instance erasure, we use a scraping script to crawl Wikipedia category pages to extract fictional character names and their page view counts with a threshold of 500,000 views from 2020.01.00 001 to 2023.12.33 resulting in 1 1,352 instances. For artistic style erasure, we use the 1,734 artistic styles collected from UCE (Gandikota et al., 2024). In evaluation, we generate 10 images per template per concept, resulting in 800 and 300 images for each concept in instance erasure and artistic style erasure, respectively. Moreover, we introduce the MS-COCO captions (Lin et al., 2014) to serve as general prior knowledge. In implementation, we use the first 1,000 captions to generate total of 1000 images to compare CS and FID before and after erasure.
Multi-concept erasure. We then compare methods on multi-concept erasure, a more challeng- ing and realistic concept erasure task. Following the experiment setup from (Lu et al., 2024a), we introduce a dataset consisting of 200 celebrities, where their portraits generated by SDv1.4 (Sta- bility AI, 2022) can be recognizable with exceptional accuracy by the GIPHY Celebrity Detector (GCD) (Hasty et al., 2019). This dataset is divided into two groups: an erasure set with 10, 50, and 100 celebrities and a retain set with 100 other celebrities. The full list for both sets is presented in Ta- ble 4. We experiment with erasing 10, 50, and 100 celebrities with the predefined target concepts and the entire retain set is utilized in all cases. In evaluation, we prepare five celebrity templates, (i.e., "a portrait of [Celebrity)" ", "a sketch of (Celebrity)" ", "an oil painting of [Celebrity)" ", "(Celebrity) in an official photo" " and "an image capturing {Celebrity) at a public event") and generate 500 images for both sets. For non-target concepts, we generate I image per template for each of the 100 concepts, totaling 500 images. For target concepts, we adjust the per-concept quantity to maintain a total of 500 images (e.g., erasing 10 celebrities involves generating 10 images with 5 templates).
C.2 ERASURE CONFIGURATIONS
Implementation of previous works. In our series of three concept erasure tasks, we mainly com- pare against four methods: ConAbI' (Kumari et al., 2023), MACE² (Lu et al., 2024a), RECE" (Gong et al., 2025), and UCE" (Gandikota et al., 2024), they achieve SOTA performance across different concept erasure tasks. All the compared methods are implemented using their default configura- tions from the corresponding official repositories. One exception is that for MACE when erasing 50 celebrities, since it doesn't 't provide an official configuration and the preserve weight varies with the number of target celebrities, we set it to 1.2 10 to ensure a consistent balance between concept erasure and prior preservation.
Implementation of SPEED. In line with previous methods (Kumari et al., 2023; Lu et al., 2024a; Wu et al., 2025b; Gong et al., 2025; Gandikota et al., 2024), we edit the cross-attention (CA) layers within the diffusion model due to their role in text-image alignment (Hertz et al., 2022). In contrast, we only edit the value matrices in the CA layers, as suggested by (Wang et al., 2024b). This choice is grounded the observation that the keys in CA layers typically govern the layout and compositional
nt npa i //g/ http:/ttt.coo//////////o/om coom//oprrmmmr /concoept ion
5 attps:: / http///tttttcct/e cww. wwwpshhiinnmeoeeeeeeee..ca.aaata LU/MACE
"nttpa: //g/ www.b.ccm//aarletteeeoe 2/RRCR
nntppa i // /l
/unt/ sed-concept-edttelee
21

---

Published as a conference paper at ICLR 2026
Original
UCE
RECE
MACE
Ours
Original
UCE
RECE
MACE
Ours
(a) Shoopy
(b) Afickey
Figure 8: Comparison of CS values across different erasure methods. We compare the results in erasing Snoopy and Mickey, and highlight the corresponding CS in blue. Our method achieves successful concept erasure with moderate CS values. In contrast, RECE achieves the lowest CS by enabling more aggressive erasure. For example, removing Snoopy into landscape without subject, and changing Mickey into a generic person. We argue that such over-erasure unnecessarily compromises prior preservation evidenced by Tables and 2.
structure of the attention map, while the values control the content and visual appearance of the images (Tewel et al., 2023). In the context of concept erasure, our goal is to effectively remove the semanties of the target concept, and we find that only editing the value matrices is sufficient in Figs. 4 and 5, which is quantitatively ablated in Appx. D.5. The augmentation times NA in Eq. 9 is set to 10 and the augmentation ranks Eq. is set to 1 as ablated in Appx. D.5. Meanwhile, given rarely strictly zero in practical applications when determining the null space, we select the singular vectors corresponding to the singular values below 10 on few-concept and implicit concept erasure and 10-4 on multi-concept erasure following (Fang al., 2024).
that eigenvalues
D ADDITIONAL EXPERIMENTS
D.1 MORE DEMONSTRATIONS
We further provide qualitative visualizations of the erasure results in Fig. 7, illustrating the effec- tiveness of our method in performing precise and targeted concept erasure across diverse scenarios. Specifically, we showcase: (a) instance erasure from Table (left); (b) artistic style erasure from Table (right); (c) celebrity erasure from Table 2; and (d) implicit concept erasure (e.g. nudity) from Table 9. In all cases, method successfully removes the intended concept while preserving unrelated content, demonstrating its universal crasure applications.
We also evaluate the CS value before and af- ter concept erasure to assess the erasure effi- cacy. As shown in Fig. 8, our method achieves successful erasure of specific concepts such as Snoopy and Mickey while maintaining moder- ate CS values (24.18 and 23.44, respectively). This indicates that effective erasure does not re-
Table 5: Human study of erasure efficacy in eras- ing Snoopy, Mickey, and Spongebob from Table 1.
Snoopy
Mickey
Spongebob
Average
RECE Ours
98.93%
98.27%
99.07%
98.76%
98.20%
98.40%
98.80%
98.47%
quire minimizing CS to an extreme. In contrast, RECE obtains the lowest CS (19.79 and 18.75), but this is achieved the cost of overly aggressive erasure. For example, transforming Snoopy into an unrecognizable image and replacing Mickey with generic human figure. While such strategies may enhance erasure efficacy, they also risk compromising prior knowledge. This trade-off reflected and 2.
in higher non-target FIDs, as shown in Tables
To further demonstrate that our current erasure adequate, we additionally conduct a human study. For our method and RECE, randomly sample 50 generated images per method erase Snoopy, Mickey, and Spongebob. We then recruit 30 human participants through Amazon Mechanical Turk (Amazon) to vote "yes" or "no" whether the target concept is visually erased not. As shown in Table 5, the overall results (RECE's 98.76% v.S. Our 98.47%) indicate that our method achieves successful erasure on par with RECE from the human perspective.
D.2 COMPLETE RESULTS ON FEW-CONCEPT ERASURE
We present complete guantitative comparisons of few-concept erasure, including both CS and FID, Table and Table 7. Our results demonstrate that our method consistently achieves superior prior preservation, indicated by higher CS and lower FID across the majority of non-target concepts.
22

---

Published as a conference paper at ICLR 2026
Table 6: Complete quantitative comparison of the few-concept erasure in erasing instances from Table 1 (left). The best results are highlighted in bold, and grey columns are indirect indicators for measuring erasure efficacy on target concepts or prior preservation on non-target concepts.
Snoapy
Mickey
Spongebob
Pikachu
Hello Kilty
MS-COCO
CS
FID
CS
FID
CS
FID
FID
CS
FID
CS
FID
26.62
27.30
27.17
26.53
Snoopy
CS J
FID 1
T
FID
CS
FID 4
CS 1
FID J
CS T
FID
CS1
FID J
ConAbl
25.44
98.38
26.63
37.08
26.95
38.92
27.47
14
27.65
36.52
26.40
21.20
MACE
20.90
165.74
23:46
105.97
23.35
102.77
26.05
65.71
26.05
75.42
26.09
42.62
18.38
151.46
26.63
27.23
27.47
21.99
27.78
32.35
26.39
25.61
UCE
102.86
27.29
29.86
19.06
27.75
26.46
SPM
23.72
116.26
26.62
31,21
27.21
31.96
27.41
19.82
27.80
30.95
26.47
20.71
SPM FT
23.72
116.26
26.55
43.03
26.84
42.96
27.38
25.95
27.71
42.55
26.48
20.86
23.50
108.51
26.67
23.41
27.31
24.64
27.48
16.81
27.82
21.74
26.48
19.95
Snoopy and Mickey
CS J
1
L
FID
CS
J
1
FID
J
ConAbl
25.26
106.78
26.58
57.05
26.81
45.08
27.34
35.57
27.74
41.48
26.42
24.34
MACE
20.53
170.01
20.63
142.98
22.03
112.01
24.98
91.72
23.64
106.88
25.50
55.15
150.84
145.59
27.29
26.05
27.71
26.31
30.30
UCE
23.60
99.30
24.79
86,32
27.32
30.58
27.38
23.51
27.74
31,76
26.38
26.06
SPM
23.18
122.17
22.71
117.30
26.92
38.35
27.35
27.13
27.76
39.61
26.45
24.59
SPM w/o FT
22.45
127.95
21.77
127.57
25.96
61.52
27.39
42.63
27.14
68.75
26.43
23.82
Ours
23.58
103.62
23.62
83,70
27.34
29.67
27.39
22.51
27.78
28.23
26.47
23,66
Brasc Snoopy and Mickey and Spongebob
CS
FID 1
L
FID
CS
CS
FID J
1
FID
FID
ConAbl
24.92
112.66
26.46
63.95
25.12
102.68
27.36
46.47
27.72
48.24
26.37
26.71
19.86
175.43
140.13
20.12
143.17
19.76
110.12
128.56
23.39
66.39
RECE
18.17
155.26
18.87
149.77
16.23
178.55
27.34
40.52
27.71
$2.06
26.32
32.51
UCE
23.29
101.40
24.63
88.11
19.08
140.40
27.45
29.20
27.82
38.15
26.30
28.71
SPM
22.86
125.66
22.08
123.20
20.92
153.36
27.45
37.51
27.63
46.63
26.48
25,47
SPM w/o FT
21.80
137.98
20.86
139.48
20.19
163.21
26.68
66.15
26.24
85.38
26.33
25.05
Owrs
23.69
103.33
23.93
86.55
21.39
109.28
27.47
21.40
27.76
26.22
26.51
24.99
Phompt:
Original:
Origial:
Origina:
Original:
painsing
Micklyy
dooodie
origarei
Snoopy"
SpongeBist"
Concepts
SPM
SPM who FT
Dore
SPM who
Oues
SPM
SPM all
SPM
Oark
Snoopy
-hoaaap
_Soapppe
-Miyley-
Figure 9: Qualitative comparison with SPM and SPM w/o FT in erasing single and multiple instances. The erased and preserved generations are highlighted with red and green boxes, respec- tively. Our method demonstrates superior prior preservation compared to both baselines. Mean- while, without Facilitated Transport, SPM w/o FT shows poorer prior preservation in multi-concept erasure (e.g., marked by with significant semantic changes compared to original generations.
D.3 COMPARISON ON MORE BASELINES
In this section, we compare against more methods because of the page limit in our main paper, in- cluding ESD* (Gandikota et al., 2023), RACE" (Kim et al., 2024), Receler (Huang et al., 2024),
attps: // http///tbtbb//cc/eee htt.h/.cm//cccc www./rchitganniikoteeeeeeeee
Pttpps: / / //tptttb..coottc/c woom/hhkimmat www.iinmm//..... A.A.C..
pttppp //gf thub.com/ httpb/ccmmaaappaaa/ Saterrrrtt--haa//oooe ler
23

---

Published as a conference paper at ICLR 2026
Table 7: Complete quantitative comparison of the few-concept erasure in erasing artistic styles from Table (right). The best results are highlighted in bold, and grey columns are indirect indica- tors for measuring erasure efficacy on target concepts or prior preservation on non-target concepts.
Van Gogh
Picasso
Monol
Poul Gauguin
Caravaggio
MS-COCo
CS
FID
FID
FID
CS
FID
CS
FID
FID
SD v1.4
28.75
27.98
28.91
29.80
26.27
26.53
Brase Van Gogh
CS
FID
1
FID
CS
FID
CS
FID
CS f
FID
CS
FID L
ConAbi
28.
129:57
27.07
77.01
63.80
29.49
63.20
26.15
79.25
26.46
18.36
MACE
26.66
169.60
27.39
69.92
28.84
60.88
29:39
56.18
26.19
69.04
26.50
23.15
RECE
26.39
171.70
27.58
60.57
28.83
61.09
29.58
47.07
26.21
72.85
26.52
23.54
UCE
28.10
133.87
27.70
43.02
28.92
40.49
29.62
32.62
26.23
61.72
26,54
19.63
ESD-X
27.04
200.05
26.50
111.07
28.14
90.35
29:45
106.70
25.70
107.85
26.10
33.19
ESD-U
26.24
205.06
26.28
153.10
27.79
105.78
29.59
164.83
26.14
124.41
26.35
38.08
RACE
23.03
233.25
25.54
127.28
26.44
94.49
27.78
106.43
25.08
114.94
25.92
41.52
Receler
21.53
245.40
24.88
134.35
23.61
143.17
25.02
194.58
24.52
133.94
25.95
37.00
Ours
26.29
131.02
27.96
35.86
28.94
16.85
29.71
24.94
26.24
39.75
26.55
20,36
Erase Pieasso
C
FID 4
4
FID f
CS
L
CS
FID
CS f
FID L
CS
FID 4
ConAbl
28.66
60.44
26.97
131.45
28.72
36.23
29.68
65.23
26.20
79.12
26.43
20.02
MACE
28.68
59.58
26.48
137.09
28.73
37.02
29.71
46.35
26.23
66.20
26.47
22.86
RECE
28.71
$1.09
26.66
126.40
28.87
25.39
29.69
46.08
26.22
75.61
26.48
23.03
UCE
28.72
37.58
26.99
102.21
28.92
16.72
29.71
32.48
26.22
59.27
26.50
20.33
ESD-X
28.58
104.48
26.07
178.18
28.32
62.79
29.31
96.70
25.84
100.54
26.15
34.12
ESD-U
28.69
109.39
26.47
156.35
28.64
67.69
29.64
95.39
26.04
105.76
26.35
35.78
RACE
28.12
112.29
24.84
185.78
27.88
72.79
28.91
93.19
25.81
110.23
25.77
42.01
Receler
25.92
199.56
23.10
243.28
26.92
94.89
26.51
208.01
25.34
135.35
25.88
37.20
Ours
28.76
19.18
26.22
117,71
28.88
19.87
29.75
24.73
26.24
43.63
26.51
19.98
Brase Monet
C
HD 4
1
FID
CS
HDD
CS
FID
CS f
HDD J
CS
FDD 4
ConAbl
28.58
68.77
27.43
64.25
27.05
96.67
29.09
57.33
26.09
71.88
26.45
21.03
MACE
28.56
61.50
27.74
48.41
25.98
116.34
29.39
49.66
25. 25.98
65.87
26.47
22.76
RECE
28.63
56.26
27.88
45.97
25.87
121.28
29.43
46.38
26.20
64.19
26.49
24.94
UCE
28.65
42.25
27.91
38.73
27.12
98.37
29.58
33.00
26.16
56.49
26.51
21.58
ESD-X X
28.15
115.51
26.56
92.69
25.97
124,90
28.85
89.07
25.92
102.53
25.98
35.79
ESD
28.73
134.10
26.87
114.64
25.15
134,02
29.44
135.64
25.72
131.90
26.21
38.16
RACE
27.13
132.42
25.99
106.70
23.08
149.16
27.52
98.71
24.96
110.34
25.81
41.96
Receler
24.94
169.55
26.16 16
105.24
21.06
182.34
24.81
199.23
25.03
122.42
25.99
36.39
Ours
28.76
28.78
27.93
41.21
25.06
134.11
29.66
27.85
26.22
55.20
26.48
20.87
Table 8: Quantitative comparison with SPM and SPM w/o FT in multi-concept erasure. The best results are highlighted in bold. Our method is capable of erasing up to 100 celebrities at once with low Acc. (%) and preserving other non-target celebrities with less appearance alteration with high Acc, (%), resulting in the best overall crasure performance H, (shaded in pink). FAIL indicates that the model collapses with noisy generations (Acc, Acc, 0.00%).
Celebrities
MS-COCO
50 Celebrities
MS-COCO
Erase Celebrities
MS-COCO
Acc.
Auc,
H. T
CS
FID
Acc, 1
Aus,
H.
CST
FID
Asc. 1
Acv. 1
H.
CS
FID
SD
91.99
89.66
14.70
26.53
12.85
26.33
17.70
26.33
SPM
0.00
51.79
68.24
26.42
48.44
0.00
0.00
FAIL
26.32
5261
0.00
0.00
PAIL
25.15
63.20
SPM
0.00
5.08
9.68
26.38
52.23
0.00
0.00
FAIL
16.22
170.68
0.00
0.00
BAIL
14.34
245.92
Our
1.81
89.09
93.42
26.47
30.02
3.46
$3.48
92.34
26.46
39.23
5.87
85.54
89.63
26.22
44.97
and "PM (Lyu et al., 2024). While the first three methods are training- based, focusing solely on modifying model parameters, SPM not only fine-tunes the model weights using LoRA (Hu et al., 2021) but also intervenes in the image generation process through Facilitated Transport. Specifi- cally, this module dynamically adjusts the LoRA scale based on the similarity between the sampling prompt and the target concept. In other words, if the prompt contains the target concept or is highly
pttpp i ///l///tttttt www.th...ccmm.. www.bb.commeeee www.mm///onn/a./ 9924/MM
24

---

Published as a conference paper at ICLR 2026
Table 9: Evaluation of implicit concept erasure in erasing nudity on four benchmarks. We report the Attack Success Rate (ASR) detected by NudeNet with threshold of 0.6. v and x indicate whether the method can defend against white-box attacks, respectively. The best and second-best results are marked in bold and underlined.
MS-COCO
White-Box Attack
12P
MMA
Ring-A-Bell
UnlearnDiff
Time
CS
FID
MACE (Lu et al., 2024a)
0.21
0.04
0.05
0.67
55 (x15)
24.06
52.78
CPE (Lev al., 2025b)
0.07
0.01
0.00
500 (x138)
26.32
48.23
AdyUnleam (Zhang et al., 2024b)
0.04
0.00
0.00
0.21
15860 (x4400))
24.05
57.22
UCE (Gandikota et al., 2024)
0.24
0.38
0.39
0.80
1.2 (x0.33)
26.24
38.60
RECE (Gong al., 2025)
0.14
0.20
0.18
0.65
1.5 (x0.41)
25.98
40.37
RACE (Kim et al., 2024)
0.23
0.29
0.21
0.47
2910 (x800)
25.54
42.73
Receler (Huang al., 2024)
0.13
0.07
0.01
5560 (x1500)
25.93
40.29
Ours w/o AT
0.20
0.24
0:20
0.75
3.6 (xl)
26.29
37.82
Ours w/ AT
0.10
0.01
0.00
0.45
4.5 (x11.25)
26.03
39.51
Table 10: Ablation study on the edited parameters. Our scheme on only editing the value matrices achieves a superior balance between erasure efficacy (e.g., target CS of 26.29) and prior preservation (e.g., the lowest FIDs across all non-target concepts).
Parameters
Gogh
Picasso
Monet
Paul Gauguin
Canavaggio
MS-COCO
Ablation
Key
Value
FID L
4
FID
FID L
CS
FID
x
27.67
42.11
26.09
28.08
52.44
26,55
18.72
v
V
26.24
48.41
28.65
33.79
57.23
26.53
23.20
Ours
x
/
26.29
35,86
16.85
24.94
39.75
26.55
20.36
relevant, this scale is set to a large value, whereas if there is little to no relevance, it is set close to O, functioning similarly text filter. We argue that such a comparison with SPM is not fair since we only focus modifying the model parameters, and therefore, we compare both the original SPM and SPM without Facilitated Transport (SPM w/o FT) for a fair comparison. the latter version, the LoRA scale is set to 1 by default.
The quantitative comparative results are shown in Tables 6 and 7, where our method consistently achieves the best prior preservation compared to all compared baselines. Even equipped with Facil- itated Transport (i.e. SPM w/ FT), our method achieves the lowest non-target FID (e.g., on Pikachu and Hello Kitry). This superiority amplifies the number of target concepts increases shown in Table 8. For example, with the number of target concepts increasing from to 3, our FID in Pikachu rises from 16.81 to 21.40 (4.59 1), while SPM increases from 19.82 to 37.51 (17.69 1), where similar pattern is observed in Hello Kitty (Our 4.48 t v.s. SPM's 15.68 t). Once removing the Facil- itated Transport module, SPM w/o FT shows poorer prior preservation with rapidly increasing FIDs (highlighted in red in Table 6). More qualitative results are shown in Fig. 9.
D.4 ON IMPLICIT CONCEPT ERASURE
Evaluation setup. We evaluate the erasure efficacy on implicit concepts (e.g., nudity), where the target concept does not explicitly appear in the text prompt. We conduct experiments on the In- appropriate Image Prompt (I2P) benchmark (Schramowski et al., 2023), which consists of various implicit inappropriate prompts involving violence, sexual content, and nudity. To evaluate adversar- ial robustness, we further introduce three adversarial attack benchmarks, including two black-box benchmarks (MMA (Yang et al., 2024b) and Ring-A-Bed (Tsai et al., 2023)) and one white-box benchmark (UnlearnDiff (Zhang et al., 2024c)). For concept erasure, we follow the setting in (Gong During evaluation, we use NudeNet (Bedapudi, 2019) with threshold of 0.6 to detect nude content and report the Attack Success Rate (ASR). Moreover, since the retain set only includes in implicit concept crasure, we add an identity matrix with weight x 0.5 to the term (C,, PMC2) in Eq. 12 to ensure invertibility.
et al., 2025) to erase nudity >
Analysis and discussion. In addition to the aforementioned methods, we introduce more adversar- ial training- based methods for comparison, including CPE (Lee et al., 2025b), AdvUnleam (Zhang et al., 2024b), RACE (Kim et al., 2024), and Receler (Huang et al., 2024). These methods enhance robustness against adversarial attacks by explicitly incorporating adversarial training objectives. We
25

---

Published as a conference paper at ICLR 2026
272
Tepet:55 Saxtageirt
26.5
Soriagering
261
355
29.00
29.9
U 1r.54
352
263
251
255
(c) Augmentation ranks Y Figure 10: Ablation study on hyperparameters. We report target CS of erasing Van Gogh and
(a) Filtering scale o
(b) Augmentation times NA
non-target FIID averaged over other four styles (i.e. Picasso, Monet, Paul Gauguin, Caravaggio).
also adapt our method with adversarial training/edittng (denoted as Ours w/ AT) following the set- ting in RECE (Gong al., 2025) to provide fair comparison. As shown in Table 9, observe that adversarial training-based methods such as CPE and AdyUnlearn achieve strong erasure efficacy but incur extremely high computational costs. Editing-based approaches like UCE and RECE are more efficient yet less robust under both black-box and white-box attacks. Notably, CPE and Receler rely on additional modules for concept erasure, which makes them particularly vulnerable in the white- box setting since attackers can directly exploit these components to bypass erasure. In contrast, our method without adversarial training (Ours w/o AT) already offers favorable balance between eff- ciency and prior preservation, and extending it with adversarial training/editing (Ours w/ AT) further improves robustness, reducing ASR across all benchmarks and lowering the white-box UnlearnDiff' score from 0.75 to 0.45 while maintaining competitive runtime and prior knowledge preservation.
D.5 ABLATION STUDIES
Edited parameters. We compare the impact on editing different CA parameters in Table 10 and draw the following conclusions: (1) Only editing the key matrices cannot achieve effective erasure, with the target CS being 27.67 (v.s. the original CS of 28.75). This is because they mainly arrange the layout information of the generation and cannot effectively erase the semantics of the target concept. (2) Simultancously editing both the key and value matrices can achieve effective erasure, but will also excessively damage prior knowledge. (3) Only editing the value matrices achieves a superior balance between erasure efficacy and prior preservation. Compared to Ablation 2, the editing of key matrices leads excessive erasure, which is unnecessary in concept erasure.
Filtering scale. We ablate the filtering threshold scale in the Influence-based Prior Filtering (IPF) module Sec. 4.1 by scaling the impact scores ju with a factor a, which controls the strength of filtering influential priors. As shown in Fig. 10 (a), varying a directly affects the trade-off between crasure efficacy and prior preservation. When a is small (i.e., close to 0), more weakly affected priors are included in the retain set, increasing its rank and overly shrinking the null space. This leads to worse erasure efficacy (higher CS) and poor preservation (higher FID). Conversely, a higher yields better erasure performance due to fewer retain concepts, but still increases the FID because of non-comprehensive prior coverage. The best balance is observed at moderate thresholds (e.g.. in our setup), achieving both effective erasure and competitive prior preservation.
We ablate the augmentation times NA proposed in the Directed Prior Aug- mentation (DPA) module in Sec. 4.2, which controls the balance between semantic degradation and retain coverage along with the Influence-based Prior Filtering (IPF) module. It can be observed from Fig. 10 (b) that: (1) As NA increases, the non-target FID exhibits a trend of first decreasing and then increasing. This suggests that when NA is small (i.e., 1 + 10), augmenting existing non-targ non-target con- cepts with semantically similar concepts facilitates a more comprehensive retain coverage. thereby improving prior preservation. However, when NA exceeds a certain threshold (i.e., 10 + 20), fur- ther augmentation of non-target concepts leads to narrowing the null-space derivation with semantic degradation, ultimately degrading prior preservation. (2) Target CS generally shows declining trend, indicating that the proposed Prior Knowledge Refinement strategy not only improves prior preservation but also exerts a positive impact erasure efficacy.
Augmentation times.
Augmentation ranks. Another hyperparameter to be ablated is the augmentation ranks r. From Eq. 7, we introduce the number of the smallest singular values, iee. augmentation ranks in deriv- ing Pmin Umin UT min with Umin = Uw [:. -r :]. Mathematically, r represents the directions in which the DPA module augment in the concept embedding space and constrains the rank of the
26

---

Published as a conference paper at ICLR 2026
augmented embeddings to maximum of r. As shown in Fig. 10 (c), increases, the non-target FID exhibits an overall upward trend, indicating that introducing more ranks does not benefit prior preservation, it narrows the null space. At the same time, shown in Table 3, such augmentation by DPA also remains necessary, as it enables more comprehensive coverage of non-target knowledge with semantically similar concepts, leading to improved prior preservation.
E LLM USAGE STATEMENT
We use large language models (LLMs) auxiliary tool during preparing this work. The LLM is employed to generate artistic style templates for the artistic style erasure task (see Appx. C.I) and refine the clarity and readability of certain parts of the manuscript, such polishing grammar, improving fluency, and standardizing terminology. In addition, LLMs are occasionally used to sug- gest alternative phrasings when writing sections like the introduction and related work, but the final narrative, arguments, and presentation choices are made solely by the authors. All methodologi- cal ideas, theoretical derivations, experiment designs, and analyses are developed independently by the authors without assistance from L.Mss. We do not rely on LLMs for generating novel research ideas, conducting experiments, interpreting results, or writing technical content. The role of LLMs is purely supportive and limited to stylistic refinement and auxiliary text generation, and thus they are not regarded as scientific contributors to this paper.
F LIMITATION
Despite the promising results, SPEED is designed with linear null-space projections, which may not fully capture the nonlinear interactions between concepts in large diffusion models. In practice, this can lead to imperfect preservation when erasing highly entangled or stylistically subtle concepts. In addition, evaluation mainly covers benchmarks with explicit implicit concepts; the effec- tiveness on more abstract (e.g-, freedom), compositional (e-g., a blue cat), or cultural (e.g., Día de los Muertos) concepts remains less explored. Finally, although our method scales efficiently 100 concepts, extending it to even larger-scale or continual crasure may require additional mechanisms.
27


Reviews:
[{"review_id": "6nkkuUm2CU", "reviewer": "Reviewer_gLg4", "summary": "This paper proposes an efficient and effective concept erasure method, SPEED. Inspired from the null-space constraints, SPEED edits model weights within the null space of non-target concepts.\nHowever, as the number of non-target concepts grows, finding the appropriate null space becomes challenging. To address this, the paper introduces Influence-based Prior Filtering (IPF), which removes the minimally affected non-target concepts from the retain set. Then, to further enhance preservation, it introduces Directed Prior Augmentation (DPA), which augments the remaining non-target concepts with semantically consistent noise. Finally, the paper proposes Invariant Equality Constraints (IEC) to ensure that the [SOT] token and the null-text embedding remain unchanged during unlearning.", "questions": "None", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The paper provides a theoretical analysis showing that the closed-form optimization used in UCE is not optimal, as its preservation error has a non-zero bound, which limits non-target preservation as the number of target concepts increases.\n- The proposed method is effective in non-target preservation and achieves a good balance between concept erasure and non-target preservation for multi-concept erasure.\n- The proposed method is efficient, which only needs 5 seconds to erase 100 concepts on a single A100 GPU.\n- The experiments are comprehensive, covering a wide range of domains including copyrighted content, artistic styles, celebrities, and nudity.\n- The ablation studies are detailed. The paper investigates which matrices in cross-attention layers should be modified, the effect of the filtering threshold in IPF, and the effect of augmentation times $N_A$ and ranks $r$ in DPA.", "weaknesses": "- The proposed method is less effective in erasing target concepts. In the copyrighted content erasure results (Table 1 left), SPEED’s CLIP scores are much higher than those of prior methods RECE and MACE. Similarly, in the multi-concept erasure experiments (Table 2), SPEED’s erasure accuracies are also higher than RECE and MACE, indicating weaker erasure performance compared to these baselines.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "U2vcjInvJu", "reviewer": "Reviewer_cb18", "summary": "This paper proposes SPEED, which resolves the issue of reduced generation quality of non-target concepts due to conflicts in optimization objectives through three modules, Influence-based Prior Filtering (IPF), Directed Prior Augmentation (DPA) and Invariant Equality Constraints (IEC). Extensive experiments have proved that the method is scalable, accurate and efficient.", "questions": "Please refer to the weaknesses.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper is well written with clear presentations, and easy to follow.\n2. Extensive experiments show that SPEED consistently outperforms existing methods in prior preservation across various erasure tasks.", "weaknesses": "1. The proposed method achieves a lower CS compared to RECE. The authors argue that an excessively low CS, as seen in RECE, results in \"over-erasure\", whereas the higher CS of SPEED is deemed \"adequate.\" How can it be proved that the residual concept has no negative impact on the erasing effect of the model?\n2. Is the IPF sensitive to the initial selection of the retention set? If the retention set is randomly sampled, is the IPF still valid?\n3. Please supplement the experiments to illustrate that SPEED has the lowest computational cost and high operational efficiency.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "YgpwZaY5Ux", "reviewer": "Reviewer_oMhk", "summary": "This paper identifies a null space to enable multi-concept erasure while preserving non-targeted concepts. To minimize the impact on non-target concepts, it selects the most affected ones based on the prior shift, which quantifies how parameter updates perturb each non-target concept. Additionally, it augments the non-target concepts by perturbing them with directed noise, guiding their embeddings toward closer semantic representations. Furthermore, it imposes constraints on certain invariants during the T2I generation process. Experimental results show that the proposed method achieves superior performance in a short amount of time.", "questions": "Could adjusting the number of non-target concepts improve concept erasure performance and achieve a better trade-off between erasure and preservation of non-target concepts?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The null space–based method demonstrates a strong ability to preserve untargeted concepts, and the closed-form solution offers high computational efficiency.\n2. The paper is well-organized. To enable accurate null-space construction, the authors use concept selection to reduce the rank of the correlation matrix. To address the resulting limited retain coverage, they further augment non-target embeddings using directed noise.", "weaknesses": "The main weakness lies in the CLIP Score, a common metric for evaluating concept erasure. \nThe results show that SPEED does not achieve the lowest CLIP Score. Although the authors provide visualizations demonstrating that erasure remains effective without reaching the minimum score, some residual patterns can still be observed. For example, in the left figure of Fig. 7(c), the mouth remains similar after removal, indicating instability in the concept erasure process.\nAlso, the concept erasure results in Table 2 show that SPEED is less effective at removing target concepts compared to other methods.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "IlMWHaNyaB", "reviewer": "Reviewer_NrN5", "summary": "This paper proposes a SPEED framework for erasing unwanted concepts in diffusion models. Specifically, this paper aims to develop a scalable, precise, and efficient concept erasure method. By formulating the concept erasure task into a null-space constrained optimization problem, the proposed framework could effectively remove the unwanted concepts while successfully preserving the unrelated concepts. This paper also proposes auxiliary strategies, including Influence-based Prior Filtering (IPF), Directed Prior Augmentation (DPA), and Invariant Equality Constraints (IEC), to prevent severe semantic degradation and improve retent set coverage. The experiments are conducted on various concept erasure tasks.", "questions": "1. In Figure 6(b), this approach shows the ability to perform model knowledge editing to edit the target concept to a specific one. Can this ability be extended to multi-concept knowledge editing?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This paper aims to enhance multiple crucial aspects of concept erasing tasks, such as scaling the setting to handle large-scale multi-concept erasing, precisely removing the target concepts solely, and reducing computation time. The proposed method facilitates the development of trustworthy generative AI.\n2. The proposed SPEED framework is reasonable and technically sound.\n3. The overall paper is easy to follow and well organized.", "weaknesses": "1. While this paper demonstrates the ability to effectively erasing the target concepts while preserving the unrelated concepts, it remains unclear whether the model could handle the paraphrased prompts, which is called robustness issues. It would lead to the target concepts being easily recovered by the paraphrase prompts with the same or similar semantics.\n2. In Figure 6, it appears that background changes in the output images. It seems removing the target concepts still affects the other parts of the images.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)