SAeUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
Authors: Bartosz Cywiński
Kamil Deja
Venue: ICML 2025 poster (2025)
Keywords: sparse autoencoder
diffusion model
unlearning
interpretability
Primary area: social_aspects->accountability_transparency_and_interpretability
TL;DR: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders

Abstract: Diffusion models, while powerful, can inadvertently generate harmful or undesirable content, raising significant ethical and safety concerns. Recent machine unlearning approaches offer potential solutions but often lack transparency, making it difficult to understand the changes they introduce to the base model. In this work, we introduce SAeUron, a novel method leveraging features learned by sparse autoencoders (SAEs) to remove unwanted concepts in text-to-image diffusion models. First, we demonstrate that SAEs, trained in an unsupervised manner on activations from multiple denoising timesteps of the diffusion model, capture sparse and interpretable features corresponding to specific concepts. Building on this, we propose a feature selection method that enables precise interventions on model activations to block targeted content while preserving overall performance. Our evaluation shows that SAeUron outperforms existing approaches on the UnlearnCanvas benchmark for concepts and style unlearning, and effectively eliminates nudity when evaluated with I2P. Moreover, we show that with a single SAE, we can remove multiple concepts simultaneously and that in contrast to other methods, SAeUron mitigates the possibility of generating unwanted content under adversarial attack. Code and checkpoints are available at [GitHub]( https://github.com/cywinski/SAeUron).

SAeUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
Bartosz Cywiński!
Kamil Deja 2
Abstract
,.FFlwwrr in Cartoon style"
F.lloeess in Magic Subestyle"
Diffusion models, while powerful, can inadver- tently generate harmful or undesirable content, raising significant ethical and safety concerns. Re- cent machine unlearning approaches offer poten- tial solutions but often lack transparency, making it difficult to understand the changes they intro- duce to the base model. In this work, we intro- duce SAeUron, a novel method leveraging fea- tures learned by sparse autoencoders (SAEs) to remove unwanted concepts in text-to-image dif- fusion models. First, we demonstrate that SAEs, trained in an unsupervised manner on activations from multiple denoising timesteps of the diffusion model, capture sparse and interpretable features corresponding to specific concepts. Building on this, we propose a feature selection method that enables precise interventions on model activations to block targeted content while preserving overall performance. Our evaluation shows that SAeU- ron outperforms existing approaches the Un- learnCanvas benchmark for concepts and style un- learning, and effectively eliminates nudity when evaluated with I2P. Moreover, we show that with a single SAE, we can remove multiple concepts simultaneously and that in contrast to other meth- ods, SAeUron mitigates the possibility of gener- ating unwanted content under adversarial attack. Code and checkpoints are available at Gi t Hub.
SAE Encoder
Cartoon features shall not pass!
SAE Decoder
F.Flwwrs in Cartooa style"
..FFlwers in Magic Cubestyle"
Figure I. Concept unlearning in SAcUron. We localize and re- move SAE features corresponding the unwanted concept (Car- toon) while preserving the overall performance of the diffusion model.
2022; Schramowski et al., 2023) copyrighted images e.g. cloning the artistic styles without consent (Andersen, 2024). The straightforward solution to this problem is to retrain the model from scratch with curated data. However, such an approach, due to the enormous sizes of the train- ing datasets both costly and impractical. As a result, a growing number of works focus on removing the influence of unwanted data from already pre-trained text-to-image diffusion models through machine unlearning (MU).
1. Introduction
Diffusion models (DMs) (Sohl-Dickstein et al., 2015; Ho al., 2020) have revolutionized generative modeling, en- abling the creation of highly realistic images. Despite their success, these models can inadvertently generate un- desirable and harmful content, pornography (Rando et al.,
'Warsaw University of Technology "IDEAS NCBR 'IDEAS Research Institute. Correspondence to: Bartosz Cywiński <bey- winskill @ gomi..com>
Most existing methods build on the basic idea of fine-tuning the model while using negative gradients for selected un- wanted samples (Wu et al., 2024; Gandikota et al., 2023; Heng & Soh, 2024; Kumari et al., 2023). To minimize degra- dation the overall model's performance, recent techniques
Proceedings of the 42nd International Conference Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

SAcUron: Interpretable Concept Unlearning in Diffussin Models with Sparse Autoencoders
restrict parameter updates to attention layers (Zhang al., 2024a) to their most important subsets (Fan et al., 2024; Wu & Harandi, 2024). A drawback of fine-tuning-basee approaches is that they offer limited understanding of how the base model changes during the process. Consequently, these methods often fail to fully remove targeted concepts and instead merely mask them, leaving the models highly vulnerable to adversarial attacks (Zhang et al., 2025).
2. Related Work
Sparse Autoencoders (SAEs) Sparse autoencoders (OI- shausen & Field, 1997) are neural networks designed to learn compact and interpretable representations of data by encouraging sparsity in the latent space. This is achieved by incorporating a sparsity penalty into the reconstruction loss, ensuring that only a small fraction of latent neurons activate for any given input. Recently, SAEs have emerged as an effective tool in the field of mechanistic interpretabil- ity, enabling the discovery of features corresponding to human-interpretable concepts (Huben et al., 2024; Bricken et al., 2023) and sparse feature circuits within language mod- els (Marks et al., 2025). In this study, sparse autoencoders are used within text-to- diffusion models to identify and disable features linked to the generative capabilities of specific concepts.
In this work, propose a conceptually different approach to unlearning in diffusion models, which we dubbed SAeU- ron. We first adapt sparse autoencoders (Olshausen & Field, 1997) to train them in an unsupervised way on the internal activations of the Stable Diffusion (Rombach et al., 2022) text-to-image (T2I) diffusion model. By using activations extracted from all of the denoising timesteps, our SAE learns set of sparse and semantically meaningful features. This allows us to block specific concept, by identifying features associated with it and removing them during the inference. Figure visualizes this idea.
Machine Unlearning in Diffussio Models The term and problem statement for machine unlearning was first intro- duced by Cao & Yang (2015), where authors transform the neural network model, through an additional simple layer, into format where output is a summation of independent features. Such a setup allows for unlearning by simply blocking the selected summation weights or nodes.
While the sparsity of SAE features ensures that unlearning of one concept has a limited influence on the remaining ones, we additionally demonstrate that the concept-specific features targeted by our approach are interpretable. As result, we can analyze them prior to unlearning, (e.g. by highlighting their activation areas or annotating them) which significantly enhances the transparency of our approach compared to other methods.
Conversely, recent works focusing on unlearning for dif- fusion models, usually employ fine-tuning in order to un- learn specific concepts. For example, EDiff (Wu et al., 2024) formulates this problem as bi-level optimization, ESD (Gandikota et al., 2023) leverages negative classifier- free guidance and FMN (Zhang et al., 2024a) introduces a new re-steering loss applied only to the attention layer. SalUn (Fan et al., 2024) and SHS (Wu & Harandi, 2024) select parameters to adapt through saliency maps or con- nection sensitivity, while SA (Heng & Soh, 2024) replaces unwanted data distribution with the surrogate one, with an extension to the selected anchor concepts in CA (Kumari et al., 2023). SPM (Lyu et al., 2024) takes a different ap- proach, using small linear adapters added after each linear and convolutional layer to directly block the propagation of unwanted content.
We evaluate our method on the recently proposed large and competitive benchmark UnlearnCanvas (Zhang et al., 2024c) which assesses unlearning effectiveness across 20 objects and 50 styles. We train two SAEs one for styles and one for objects- - each using activations gathered from a single selected SD block and show that our blocking approach achieves state-of-the-art (SOTA) performance in unlearn- ing without affecting the overall performance of the DM. Evaluation on I2P shows that our approach also effectively removes nudity. Importantly, due to the fact that SAEs are trained in an unsupervised way, SreUron is highly robust to adversarial attacks and seamlessly scales to removing mul- tiple concepts simultaneously, contrary to other methods. The summary of our contributions is as follows:
By contrast, methods that do not rely on fine-tuning include SEOT (Li et al., 2024), which eliminates unwanted content from text embeddings, and UCE (Gandikota et al., 2024), which adapts cross-attention weights using a closed-form so- lution. Unlike these approaches, we neither modify prompt embeddings nor alter the base model's weights.
We demonstrate that SAFS extract meaningful and in- terpretable features from the internal activations of diffusion models across multiple denoising timesteps.
We propose SAcUron, an interpretable unlearning method that localizes features corresponding to un- wanted concepts and ablates them, achieving state-of- the-art performance.
In this paper, we revisit the pioneering work by Cao & Yang (2015) adapting it to the text-to-image diffusion models us- ing recent advancements in mechanistic interpretability. In particular, we train a sparse autoencoder on the activations of the diffusion model and leverage its summative nature to unlearn concepts by blocking unwanted content. Most simi-
We demonstrate that SAeUron enables seamless un- learning of multiple concepts simultancously and ex- hibits high robustness against adversarial attacks.
2

---

SAcUron: Interpretable Concept Unlearning in Diffussin Models with Sparse Autoencoders
larly our approach, Farrell et al. (2024) show that SAES can be employed to remove a subset of biological knowl- edge in large language models (LLMs), while Guo et al. (2024) benchmark several mechanistic interpretability tech- niques for knowledge editing and unlearning in LLMss. In the concurrent work (Kim & Ghadiyaram, 2025), a similar idea was used to unlearn concepts in DM's text encoder.
3. Sparse Autoencoders for Diffusion Models
In this work we adapt sparse autoencoders to Stable- Diffusion text-to-image diffusion model. Importantly, un- like previous works utilizing SAEs for diffusion models, we train them activations extracted from every step t of the denoising diffusion process. These activations are obtained from the cross- tross-attention blocks of the diffusion model and form feature maps. Each feature map extracted at timestep is a spatially structured tensor of shape Ft E IR Axxxd where h and w denote the height and width of the feature map, and is the dimensionality of each feature vector. Each spatial position within the feature map corresponds to patch in the input image.
Interpretability of Diffusion Models Numerous studies explored disentangled semantic directions within the bottle- neck layers of UNet-based diffusion models (Kwon al., 2023; Park et al., 2023; Hahm et al., 2024) and analyzed cross-attention layers to investigate their internal mecha- nisms (Tang et al., 2023). Despite these efforts, detailed interpretation of the specific functions and features learned by specific components in T2I diffusion models remains lim- ited. Recently, Basu et al. (2023; 2024) localized knowledge about visual attributes in DMs, showing that modifying text input in few prossattenttion layers can consistently alter attributes like styles, objects or facts. Additionally, Toker et al. (2024) aimed to interpret T21 models' text encoders by generating images from their intermediate representa- tions. In contrast, our work employs sparse autoencoders to achieve a more fine-grate -reigga understanding of the internal representations in diffusion models.
As a single SAE training sample, we consider an individual d-dimensional feature vector, disregarding the information about its spatial position. Therefore from each feature map, we obtain h x w training samples. For simplicity, we drop the timestep index l in subsequent notations.
Let x E Hd denote the d-dimensional vector of activations from a single position of a feature map and let be the latent dimension in sparse autoencoder. The encoder and decoder of standard single-layer ReI.U sparse autoencoder (Bricken et al., 2023) are then defined as follows:
ReLU (Wone(x bpre) + bene)
Although SAEs are widely used in the language domain, their application to vision remains limited. Early studies applied them to interpret and manipulate CLIP (Radford et al., 2021) representations (Fry, 2024; Daujotas, 2024) or traditional vision networks (Szegedy et al., 2015; Gorton, 2024). More recently, SAEs have been successfully applied in vision- Laiiunl models (VLMs) to tackle problems such as mitigating hallucinations (Jiang et al., 2025) and generat- ing interpretable radiology reports (Abdulaal et al., 2024). To date, only few studies have utilized SAES to investi- gate the inner workings of T2I diffusion models. Ijishakin et al. (2024) use SAES to identify semantically meaningful directions within the bottleneck layer. Surkov et al. (2024) trained SAEs on activations from a one-step distilled SDXL- Turbo diffusion model, demonstrating that SAFS can detect interpretable features within specific model's blocks and en- able causal interventions on them. Furthermore, Kim et al. (2024) applied SAEs to activations from the diffusion model sampled in an unconditional way. By training a separate SAE model for each diffusion timestep, they revealed the visual features learned by these models and their connection to class-specific information.
(I)
* = Wdcc + bpre.
where Wene E Raxd and Waee E Rdxx are encoder and decoder weight matrices respectively, bpe E Bd and bene E R" are learnable bias terms. Elements of z called feature activations are usually denoted as fi....((x), Typically, n is equal to d multiplied by a positive expansion factor.
The objective function of SAE is defined as:
[(x)
||x
x
+ CLCaxx,
(2)
where ||x- 1 is a reconstruction error and Laux is a recon- struction error using only the largest kaux feature activations that have not fired on a large number of training samples, so-called dead latents. The auxiliary loss is used to prevent dead latents from oceurring and is scaled by coefficient
In our work, we additionally apply two extensions over vanilla ReLU SAEs. First, we follow Gao et al. (2025) and use the TopK activation function (Makhzani & Frey, 2013) which retains only the k largest latent activations for each vector x, setting the rest zeros. While the decoder remains unchanged, the encoder is thus redefined to:
In contrast to prior approaches, our work involves training single SAE on activations from multiple denoising steps of a standard, non-distilled Stable Diffusion model. Addi- tionally, we leverage the well-disentangled and interpretable features learned by SAES for downstream unlcarning tasks, showcasing their potential in real-world use cases.
z = Topk (Wene(x bbree))))
(3)
Second, we leverage the BatchTopK approach introduced by Bussmann et al. (2024), which dynamically selects the B k largest feature activations across the entire input data
3

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
(a) Score-based feature selection
Removing Frogs during inference
Feature activations
Important for Progs?
New feature activations
Feature
Important?
activations
Frogs Dogs
X Y
Frogs
X
SAF SAF. Enender
Negative multiplier
SAE Decoder
SAE Encoder
x X
1
Dogs
Input
Output
T234
1234
Frogs
Dogs
Test prompt: "An image of Frogs in Color Fantasy style."
Figure 2. Unlearning procedure in SAeUron, (a) Concept-specific features are selected for unlearning according to their importance scores. (b) During inference in the U-Net the diffusion model, activation between selected cross-attentin blocks is passed through a trained SAE. The selected SAE features are then ablated by scaling them with negative multiplier removing their influence on the final output. The remaining features are left unchanged, ensuring minimal impact on the overall model performance.
batch of size B during training. It allows the SAE to more flexibly distribute active latents across samples. During inference, k is fixed BatchTopK SAEs tend to activate more frequently in the central regions of samples while allocating fewer latents to the image borders, as presented in Appendix A. This aligns with the nature of the LAION dataset (Schuhmann et al., 2022) used for the training of the SD model.
that does not Dec. we define score as:
1(i,l,
constant value. We observed that
score(i,t,c,D)
p(j.t, U. D.) +
(4)
p(i, 1, D_.)
Sj=1 Σソ=1 M(j, t, D D=c)) +
where 6 is small constant added to prevent division by zero and p(i,t, t, = Do) ExED fx(,) denotes the aver- age activation of i-th feature activations from a timestep t. To ensure that features activating on many concepts do not dominate the scores, we normalize both components by the average activation values for the corresponding subsets of the dataset. Thus, features with high scores exhibit strong activation for concept e while remaining weakly activated for all other concepts. Figure 3 shows histogram of scores calculated for each prompt and timestep using our validation set. Importantly, only a small fraction of features achieve high scores, indicating that SAE learns limited number of concept-specific features. Consequently, we target high- scoring features our method to unlearn concepts without affecting the overall performance of a model, blocking only Te features with the highest scores. Additionally, we filter out features based their activation frequency exclude dead features and those activating too frequently (more of- ten than the 99th percentile of feature density distribution, presented in Figure 14 in the Appendix).
4. Method
Given a trained sparse autoencoder able to reconstruct ac- tivations of the diffusion model, our SAeUron method for concept unlearning involves two steps. First, we identify which SAE features will be targeted for unlearning a spe- cific concept c. This selection is based on the importance scores associated with features. Then, during the inference of the diffusion model, we encode the original activations with SAE, ablate the selected features to remove the tar- geted concept associated with them, and decode them back. Thanks to the summative nature of SAES and the sparsity of activated features, this process effectively removes the influence of the targeted concept on the final generation, while preserving the overall performance of the diffusion model. We present the overview of our method in Figure 2.
4.1. Selection of SAE features for unlearning
To identify SAE features that exhibit strong correspondence exclusively to the target concept c, we define score func- tion that measures the importance of each i-th feature for concept at every denoising timestep f. Utilizing dataset of activations from the diffusion model D DD U D- which includes data containing a target concept D, and data
4.2. SAE-based concept unlearning
Building on the method introduced for locating features that correspond to specific concepts, we now present our SAE-based unlearning procedure, which we apply for each timestep during the inference of the diffusion model. To

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
show that different cross-attention blocks specialize in gen- erating specific visual aspects like style objects. Building this fact, apply our unlearning technique to activa- tions from key cross-attention blocks. For style filtering, we use second to last up-sampling block up. 2, and for object filtering up. 1 11 identified empirically as the most effective. Exemplary generations demonstrating the effects of ablating these blocks are presented in Appendix C.
99.999th Percentile
Number of Features
10'
10"
10'
10'
0.00
0.05
0.10
0.15
Unlearn benchmark (Zhang al., 2024c) is large benchmark aiming to extensively evaluate MU methods for DMs. Benchmark consists of 50 styles x 20 objects, provid- ing a test bed both for style and object unlearning evaluation. Authors, along with a dataset, also provide a Stable Diffu- sion v1.5 model fine-tuned on the selected objects and styles from the benchmark, ensuring a fair evaluation.
Feature Importance Score
Figure 3. Feature importance scores. Most of the features have near-zero scores, indicating that SAE learns only few concept- specific features. During the evaluation, we find the most important features according this score and block them.
that end, utilize previously trained sparse autoencoder applied to a single U-Net cross-attention block.
SAE training dataset To ensure fair evaluation, the SAE training set is comprised of text prompts that are distinct from those employed in the evaluation on the UnlearnCan- vas benehmark. Specifically, we utilize simple one-sentence prompts (referred to as anchor prompts), which were em- ployed by the authors of the benchmark in training of the CA method (Kumari al., 2023). For each of the 20 objects, use 80 prompts. Additionally, to enable the SAE to learn the styles used in the benchmark, we append the postfix "in {style} style." to each prompt.
To unlearn a concept c, we first identify a set of SAE features F. associated with e and compute their average activations on a validation dataset D:
F = {i E Top-re (op-cc((score(t,,,c,,))) D)})} m(() = (i,,, F.
(5)
Then, cut the connection in the diffusion model between the block SAE was trained on and the subsequent one, ap- plying trained SAE in between them. During inference, the SAE encoder decomposes each activation vector x from the feature map Ft of the previous cross-attention block fol- lowing Equation (3). Then, activations of selected features Fe are ablated by scaling them with negative multiplier To < normalized by the average activation on concept samples p(i, t, Dz). This removes the influence of the tar- geted concept on the activation vector x. In summary, each i-th latent feature activation is modified as follows:
For each generation, we collect the internal activations from the specified cross-attention blocks across 50 denoising camesttes.Importaune we only gather feature maps related to text-conditioned generation part, discarding the uncondi- tioned ones. Nonetheless, during inference, trained SAEs reconstruct both parts of feature maps. Appendix E provides details on SAE training.
Validation dataset for feature score calculation To calcu- late feature scores during the unlearning of concept e, we collect feature activations (xx) at each denoising timestep using validation set 'D of anchor prompts, similar to SAE's training set. Following the UnlearnCanvas evaluation setup, activations are gathered over 100 denoising timesteps. Despite being trained on 50 steps, SAES generalize well to this extended range. For style unlearning, we use 20 prompts per style and for object unlearning 80 per object. Style validation prompt templates are shown in Appendix B.
F.A f((x) p(i,t,D), (6) otherwise.
(x)x f((x),
f((x)
The condition fi(x): > ()) ensures that only signifi- cant features are selected, preventing random feature abla- tion when all scores are low. The modified representations are decoded back using the SAE decoder, preserving the error term, and passed to the next diffusion block. An overview of this procedure shown in Figure 2, with pseu- docode provided in Appendix S. Procedure involves two hyperparameters: Te and Ye. further discussed in Section 5.3.
5.2. Interpreting SAF features
Before presenting the experimental results for our SAE- based unlearning method, we first evaluate how well the sparse encoding captures the concepts to be unleamnd.. Specifically, we assess whether the features selected us- ing our score-based approach correspond to the desired concepts, as selecting relevant features is critical to our method's success. Additionally, we examine the image re-
5. Experiments
5.1. Technical details
Where to apply SAEs Recent studies on mechanistic in- terpretability in diffusion models (Basu et al., 2023; 2024)
5

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
100
Bricks Style Features
Butterll
Object Feetuues
Butterfly.
Butterfly.
Horses,
Butterfly.
Butterfly.
Horses,
Bricks
Photo
Bricks
Bricks
Phuto
Bricks
80
Accuracy [%]
Score-hased selection
Original
60-
All features
Random features
40
Random guess
Timestop
Timestep 60
100
60 40
20
Timestep
Timestep
Figure Object classification with k-nearest neighbors algo- rithm based SAF feature activations. Features selected with our score-based selection approach demonstrate strong discrimi- native power across timesteps. Even randomly selected features exhibit notably higher accuracy than random guess baseline, prov- ing that SAE learns meaningful visual attributes.
Test prompt: "An image of (object) in (stylle style."
Figure 5. Activations of features selected for unlearning dis- played on image patches. (Left) Features corresponding to the Bricks style strongly activate patterns characteristic of this style. (Right) Conversely, Butterfly-relatee features activate successfully on image regions containing the object, regardless of the style.
gions where these features strongly activate to verify their connection to the targeted concepts and their alignment with numan-interpretable attributes.
Temera
Fentar
Parture
Testura
5.2.1. 1. DO FEATURES EXHIBIT DISCRIMINATIVE POWER?
Timestep
To validate whether SAE learns meaningful visual features, train a 5-nearest neighbors classifier SAE feature acti- vations extracted each timestep from the validation dataset used for the score calculation. Importantly, activations are gathered from the unconditional part of the generation to exclude the influence text embeddings. each setup, we use 40 features, with features per class.
12029
Timestop
Fastan 11:0
Toster t61
Farter 1i11
Feltar 17638
Famure 2019
Timesiop 30
Figure shows object classification accuracies across timesteps. As expected, when use all features the accu- racy improves as denoising progresses, due to the emergence of object-relevant visual attributes. Notably, our score-based selection approach identifies the most important features, achieving high accuracy across most timesteps. Interest- ingly, randomly selected SAE features (matching the num- ber chosen by the score-based method) still exhibit discrimi- native power, significantly outperforming the random guess baseline. These results confirm that method effectively selects the most concept-relevant features and signifies that SAE successfully learns meaningful visual features from the diffusion model. Analogous results for style classification are shown in Figure 16 in the Appendix.
Timestep
Figure 6. The most important features for Cats unlearning ac- cording to our score-based approach across timesteps. Features are sorted by importance in each row from left to right. Examples for other objects are presented in Appendix M.
sponding generated image by predicting the fully denoised sample X from the diffusion model's representation
The visualizations reveal that style-related features strongly activate patches with characteristic style patterns while remaining inactive elsewhere. Notably, these features focus on style-related backgrounds while ignoring object regions, demonstrating the precision of our score-bare based selection in isolating style features. Similarly, object-related features activate only on the targeted object, regardless of the back- ground style.
5.2.2. DO FEATURES RELATE TO CONCEPTS?
To further enhance our understanding of features learned by SAEs, visualize their activations corresponding image patches to assess whether they relate to interpretable patterns. We generate heatmaps of activations from features selected by our score- based approach, normalized to the range [0, 1). and overlay them on the generations, as shown in Figure 5. For each timestep f, we visualize the corre-
A key advantage of our approach is the ability to directly observe which features are modified to remove a specific concept. Figure shows examples of the most important features our score- based method selected for unlearning the Cats class. We see that these features are highly inter-
6

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
Table 1. Evaluation of SAeUron against otate-of-the-art methods style and object unlearning. The best result for each metric is highlighted in bold, and the second-best is underlined. Our approach significandly outperforms others on style unlearning and performs comparably on object unlearning. Importantly, SAeUron demonstrates consistent performance across all metries.
Effectiveness
Efficiency
Method
Style Unlearning
Object Unlearning
Memory (GB) (4)
Storage
Avg. (1)
FID (
UA (t)
IRA (1)
CRA (1)
UA (t)
IRA (1)
CRA (t)
(GB) ())
ESD (Gandikota et al., 2023)
98.58%
80.97%
93.96%
92.15%
55.78%
44.23%
77.61%
65.55
17.8
4.3
FMN (Zhang al., 2024a)
88.48%
56.77%
46.60%
45.64%
90.63%
73.46%
66.93%
131 37
17.9
4.2
UCE (Gandikota al., 2024)
98.40%
60.22%
47.71%
94.31%
30.35%
34.67%
62.45 45%
182.01
5.1
1.7
CA (Kumari et al., 2023)
60.82%
96.01%
92.70%
46.67%
90.11%
81.97%
78.05%
54.21
10.1
4.2
SalUn (Fan et al., 2024)
86.26%
90.39%
95.08%
86.91%
96.35%
99.59%
92.43%
61.05
30.8
4.0
SEOT (Li et al., 2024)
56.90%
94.68%
84.31%
23. 23.25%
95.57%
82.71%
72.91
62.38
7.34
0.0
SPM (Iyu et al,, 2024)
60.94%
92.39%
84.33%
71.25%
90.79%
81.65%
80. 20.23%
59.79
6.9
0.0
EDiff (Wu et al., 2024)
92.42%
73.91%
98.98%
86.67%
94.03%
48.48%
82.41%
81.42
27.8
4.0
SHS (Wu& & Harandi, 2024)
95.84%
80.42%
43. 43.27%
80. 73%
81.15%
67.99%
74.90%
119.34
31.2
4.0
SAeUron
95.80%
99.10%
99.40%
78.82%
95.47%
95.58%
94. 94.03%
62.15
2.8
0.2
pretable and often represent monosemantic concepts like ears, paws or whiskers, We also find that features learned by our SAEs tend to be either low-frequue frequency (activating mostly in the early diffusion timesteps) high-frequency (activat- ing in middle and later timesteps). Although low-frequency features activate on image areas related to objects or back- grounds, their detailed interpretation needs further study. Visualizing these removed features provides greater control and transparency over the unlearning process. This includes helping to detect and explain failure cases, as discussed in Appendix O.
100
80-
Average Score [%)
60
40
ESD
CA
EDiff
20-
FMN
SalUn
SHS
UCE
SPM
Ours
To further highlight the potential of SAEs not only for un- learning tasks but also as a general tool for interpreting diffusion models, we extend this analysis by automating fea- ture annotation using VLMs (Appendix T), which provide text descriptions for features, making it easier to understand what they represent.
2
3
Number of Concepts
Figure 7. Evaluation sequential unlearning of multiple con- cepts. Results present the average of unlearning accuracy (UA) and retaining accuracy (RA IRA+CRA). ). SAcUron achieves supe- rior unlcarming effectiveness while retaining the overall model's performance. At the same time, we observe significant drop in retaining the ability of competing approaches.
5.3. Concept unlearning with SAeUron
features Ta and negative multiplier %e- For style unlearning we empirically observed that setting To 1 and %e yield satisfying results across all styles. For the case of object unlearning we tune hyperparameters on the validation dataset, presenting the selected values in Appendix G.
Metrics We evaluate our method on unlearning tasks us- ing metrics from the UnlearnCanvas, calculated using Vi- sion Transformer-basedd (Dosovitskiy et al., 2021) classifiers provided by the authors of the benchmark. Assuming that we want to remove concept unlearning accuracy (UA) measures the proportion of samples generated from prompts containing e that are not correctly classified. In-domain retain accuracy (IRA) quantifies correctly classified sam- ples with other concepts, while cross-domain retain accu- racy (CRA) assesses accuracy a different domain (e.g., in style unlearning, we calculate object classification accuracy). Additionally, we measure the overall quality of images gen- erated after unlearning through FID (Heusel et al., 2017). 7). This set of metrics enables evaluating each method's effec- tiveness in removing concepts from the base model while preserving the generative capabilities of others.
Results We evaluate SAeUron on style and object unleam- ing tasks using the UnlearnCanvas benchmark, comparing it to state-of-the-art methods. Table I presents results aver- aged over 5 random seeds, with competing method results taken from UnlearnCanvas. Despite using unsupervised SAE features, SAeUron significantly outperforms all meth- ods in style unlearning and ranks second in object unlearn- ing, achieving the best overall average performance.
Unlike other approaches that train a separate model for each removed concept, SAcUron requires SAE training on just two cross-attention blocks once. Additionally, SAES are lightweight, requiring minimal memory and storage. No- tably, SAeUron maintains stable performance across both
Hy peepaaarreesers Our method uses two hyperparameters tunable for each concept separately: number of blocked
7

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
Object Unlearning
Style Unlearning
Base Model
Trees
Frogs
Sandwiches
Van Gogh
Artist Sketch
Mosaic
Trees,
Van Gogh
Frogs,
Artist Sketch
Sandwiches, Mosuic
Test prompt: "An image of (object) in (style) style."
Figure 8. Qualitative evaluation of SAeUron on object and style unlearning. For more examples and comparison with contemporary methods, see Appendix P.
unlearning (UA) and preservation metrics (IRA, CRA). This is contrary to the other methods which mostly fail to effec- tively balance those two aspects.
30k prompts from the COCO validation set measure the model's overall quality when applying SAE. As shown in Table 2, SAeUron achieves state-of-the-ar performance in removing nudity while preserving the model's overall quality. This highlights the potential of our method in real- world applications.
Figure 8 present qualitative results showcasing the workings of our method on the unlearning task. SAeUron removes unlearning target while preserving other visuals. Our find- ings confirm that SAEs are effective for real-world tasks like unlearning in diffusion models. Moreover, the inter- pretability of our method, which explicitly relies small features, provides an addi-
6. Additional experiments
6.1. Unlearning of multiple concepts
number of numan-interprette tional advantage, making SAeUron transparent approach for real-world applications.
Recent studies show that traditional machine unlearning approaches, while effective for removing a single concept, struggle in scenarios requiring the sequential removal of multiple concepts from a diffusion model (Zhang et al., 2024c). In contrast, SAeUron enables seamless filtering of multiple concepts with minimal impact on other concepts. We evaluate our approach against competing methods on sequential unlearning of 6 styles, with results presented in Figure 7. Notably, the performance of other methods drops as the number of targeted concepts increases, due to the growing degradation of the model's overall performance. By selectively removing a limited subset of features strongly tied to the targeted concepts, SAeUron achieves superior retention of non-targeted concepts. To further evaluate the retention capabilities of our approach, we run additional experiment with an extreme scenario where we unlearn 49 out of 50 styles present in the Unlearnaavvas benchmark (leaving one style out to evaluate the quality of its preser- vation). We observe almost no degradation in SAcUron performance for three randomly selected combinations. For unlearning of 49/50 styles simultaneously, we observe UA: 99.29%, IRA: 96.67%, and CRA: 95.00%. Further details on the evaluation setup are provided in the Appendix D.
5.4. Nudity unlearning
To highlight the potential of SAeUron in real-world appli- cations, we extend our study to the evaluation with the I2P benchmark, focusing on the real-world application of NSFW content removal. To do that, we use an established 12P benchmark consisting of 4703 inappropriate prompts. We train SAE on SD-v1.4 activations gathered from random 30K captions from COCO train 2014. Additionally, we add to the train set prompts "naked man" and "naked woman" features. SAE is trained on up. 1. 1 block, following all hyperparameters used for class unlearning setup. We use our score- based method to select features related nudity, selecting fea- tures that strongly activate for "naked woman" or "naked man" prompts and not activating on a subset of COCO train captions.
to enable SAE to learn nudity-relevan
Following other works, we employ the NudeNet detector for nudity detection, filtering out outputs with confidence less than 0.6. Additionally, we calculate FID and CLIPScore
8

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
Table 2. Nudity unlearning evaluation on the 12P benchmark. The best result for each metric highlighted in bold.
Method
Armpits
Belly
Buttocks
Feet
Breusts (I)
Genitalia (F)
Breusis (M)
Genitalia (M)
Total
CLIPSccre (1)
FID ())
FMN (Zhung 2024a)
43
117
12
155
2
424
30.39
13.52
CA (Kumari et al. 2023)
153
180
45
66
298
22
67
7
838
31.37
16.25
AdvUn (Zhang et al., 2024b)
8
0
0
13
1
0
28
28.14
17.18
Receler (Huang
2024)
48
32
3
20
17
5
160
30,49
15.32
MACE et al., 2024)
17
19
2
16
9
7
111
29.41
13.42
CPE al., 2025)
10
2
31.19
UCF (Gandikeota et al,, 2024)
29
62
7
29
35
5
II
4
182
30.85
14.07
SLD-M (Schramowski et al.,, 2023)
47
72
3
39
26
3
212
30,90
16.34
ESD-x (Gandikkta al., 2023)
59
73
12
100
18
8
315
30.69
14.41
ESD-a (Gandikota et al., 2023)
32
30
2
19
27
2
123
30.21
15.10
SAeUron
30.89
v1.4
148
170
29
266
18
42
7
743
31.34
14.04
SD v
105
1.59
17
177
9
57
2
586
31.53
14.87
Before UnlearaDitAAkk
After UnlsamDiEAAsk
strengths and limitations. Most importantly, in order to maintain high-quality retention of the remaining concepts, we have to train SAE on activations gathered from a reason- able number of various data samples (see Appendix N for more details). This might bring some computational over- head when trying to unlearn a single concept. On the other hand, such an approach naturally allows us to efficiently unlearn several concepts the same time without the need for any additional training. This also includes concepts not present in the SAE training set, as validated in Appendix F. Another limitation when compared to pmetuning-basee un- learning is that our solution can only be employed in practice in a situation where users do not have direct access to the model, would be relatively easy remove the blocking mechanism in the open-source situation.
100
Ualcaming Ascuracy [%)
Hillll Ours
40
ESD FMN UCB
CA SalUn SEOT SPM EDiff SHS
Figure 9. Robustness to adversarial prompts crafted using Un- learnDiffAtk method. Our blocking approach demonstrates strong robustness adversarial prompts, as evidenced by mini- mal drop in unlearning accuracy under attack scenarios. In contrast, competing methods exhibit significant vulnerability.
6.2. Robustness to adversarial attacks
Additionally, training SAEs demands significant storage for activations, posing challenges for large datasets. However, as presented in Table 1. when compared to other techniques our approach has low GPU and storage requirements.
Finally, as shown by Zhang et al. (2025), recent unlearn- ing works do not always fully block the unwanted content, making it possible bypass the unlearning mechanisms. In particular, authors show that when prompted with crafted adversarial inputs models can still be forced to generate un- learned concepts. We evaluate SAeUron under the Unlearn- DiffAtk method (Zhang et al., 2025), optimizing a 5-token prefix for 40 iterations with a learning rate of 0.01. Figure 9 shows unlearning accuracies before and after the attack for all methods. Competing approaches suffer significant per- formance drops, suggesting they primarily mask concepts instead of unlearning them. In contrast, our method, by filtering internal activations of the diffusion model, remains highly robust, showing minimal performance degradation. We present similar evaluation for robustness to adversarial attacks nudity unlearning in the Appendix L.
Finally, as we apply our approach to the diffusion model's activations, we observe limitations in performance, particu- larly when attempting to unlearn concepts while preserving similar ones, or when targeting abstract concepts lacking distinct visual characteristics (see Appendix O).
8. Conclusions
In this work, we propose SAcUron, a novel method lever- aging sparse autoencoders to unlearn concepts from text- to-image diffusion models. Training SAEs on activations from DM, we demonstrate that their sparse and interpretable features enable precise, concept-specific interventions while maintaining overall model performance. Method's 's reliance on interpretable features enhances transparency, allowing for clearer understanding of the unlearning process. SAeUron achieves SOTA results on the UnlearnCanvas benchmark, showcasing robustness to adversarial attacks and the capa- bility to unlearn multiple concepts sequentially.
7. 7.Lin Limitations
There are several limitations of our approach serving as in- teresting future work directions. SAcUron operates during inference, introducing a 1.92% overhead, which slightly slows down the generation process. Moreover, the two- phase approach that we employ in our work brings both

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
Acknowledgments
Cao, Y. and Yang. J. Towards making systems forget with machine unlearning. In 2015 IEEE symposium on security and privacy, pp. 463-480. IEEE, 2015.
The project was funded by the National Science Centre, Poland, grant no: 2023/5 1/B/////030004 and by the Warsaw University of Technology within the (YoungPW) program. The computational resources were provided by PLGrid grant no. PLGG/2224/012666 and the LUMI consortium through PLL/2024407/017411. The project "ELIAS: Eu- ropean Lighthouse of AI for Sustainability" has been sup- ported by the Horizon Europe Programme under GA no. 101120237.
Daujotas, G. Case study: Interpreting, manipulating, and controlling clip with sparse autoencoders, 2024. URL https: /ttp:://tiiig/ /tt.ttinurrrrr// 306mm/3uy9wwl 9wz5.
Dosovitskiy, A., Beyer, I.., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M. Heigold, G., Gelly, S., Uszkoreit, J., and Houlsby, N. An image is worth 16x16 words: Transformers for image recognition at scale. International Conference on Learning Representations, 2021. URL https:// openreview net /
Special thanks to Eliza Rajkowska for invaluable help with the design of figures in this work and for her encouragement during the many late nights.
Impact Statement
Fan, C.,, Liu, J., Zhang, Y., Wong, E., Wei, D., and Liu, S. Salun: Empowering machine unlearning via gradient-based weight saliency in both image classifica- tion and generation. In The Twelfth International Confer- ence on Learning Representations, 2024. URL https: / /pperevview net forum? wwt.:iiddigmmmhgghhn..m
This paper presents work whose goal advance the field of Machine Learning. There are many potential societal consequences of our work. In particular, while method was designed to block and remove selected unwanted, biased or harmful content it can be misused to promote it instead.
Farrell, E., Lau, Y.T., and Conmy, A. Applying sparse autoencoders to unlearn knowledge in language models. arXiv preprint arXiv:2410.19277 2024.
References
Abdulaal, A., Fry. H., Montaña-Browee N., Ijishakin, A., Gao, J., Hyland, S., Alexander, D. C., and Castro, D. C. An x-ray is worth 15 features: Sparse autoencoders for interpretable radiology report generation. arXiv preprint arXiv:2410.03334, 2024.
Fry, H. Towards multimodal interpretabillty: Learning sparse interpretable features in vision transformers, 2024. URL https: http:::////irrll//// com/mrx5c3pc.
Gandikota, R., Materzynska, J., Fiotto-Kaufnan, J., and Bau, D. Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 2426-2436, 2023.
Andersen. Andersen v. stability ai Itd., 2024.
Basu, S., Zhao, N., Morariu, I., Feizi, S., and Manjunatha, V. Localizing and editing knowledge in text-to- gen- erative models. In The Twelfth International Conference on Learning Representations, 2023.
Gandikota, R., Orgad, H., Belinkov, Y., Materzyúska, J., and Bau, D. Unified concept editing in diffusion models. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision ( (WACV), pp. 5111-5120, January 2024.
Basu, S., Rezaei, K., Kattakinda, P., Morariu, V. Zhao, N., Rossi, R. A., Manjunatha, V., and Feizi, S. On mecha- nistic knowledge localization in text-to-image generative models. In Forty-first International Conference on Ma- chine Learning, 2024.
Gao, L.. Tour, D., Tillman, H., Goh, G., Troll, R., Radford, A., Sutskever, I., Leike, J., and Wu, Scaling and evaluating sparse autoencoders. In The Thirteenth International Conference on Learning Representations, 2025. URL https: h http///ppeeeeeeeee/ee/ee/ee/eeee net forum? id=tcs2t
Bricken, T., Templeton, A., Batson, J.. Chen, B., B., Jermyn, A., Conerly, T., Turner, N., Anil, C., Denison, C., Askell, A., Lasenby, R., Wu, Y., Kravec, S., Schiefer, N., Maxwell, T., Joseph, N., Hatfield-Dodds. Z., Tamkin, A., Nguyen, K., McLean, B., Burke, J. E., Hume, T., Carter, S., Henighan, T., and Olah, C. Towards monosemanticity: Decomposing language models with dictionary learning. Transformer Circuits Thread, 2023. https://transormmr-
Gong. C., Chen, K., Wei, Z., Chen, J., and Jiang, Y.-G. Reliable and efficient concept erasure of text-to-image diffusion models. In European Conference Computer Vision, pp. 73-88. Springer, 2024.
Gorton, L. The missing curve detectors of inceptionvl: Applying sparse autoencoders to inceptionv! early vision. arXiv preprint arXiv:2406. 03662, 2024.
Bussmann, B., Leask, P., and Nanda, N. Batchtopk sparse autoencoders. arXiv preprint arXiv:24/2.064 2024.
10

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
Guo, P., Syed, A., Sheshadri, A., Ewart, A., and Dziugaite, G. K. Mechanistic unlearning: Robust knowledge learning and editing via mechanistic localization. arXiv preprint arXiv:2410.1294 2024.
Kim, D., Thomas, X., and Ghadiyaram, D. Revelio: Inter- preting and leveraging semantic information in diffusion models. arXiv preprint vrXiv:2411.1672. 2024.
Kingma, D. Adam: method for stochastic optimization. arXiv preprint arXiv:1412.6988) 2014.
Hahm, J., Lee, J., Kim, S., and Lee, J. Iso- metric representation learning for disentangled latent space of diffusion models. In International confer- ence on machine learning, volume abs/2407.11451, 2024. URL htt.s:/ppp.smmaatiiesseieee semanticscholas org/CoozpuSD::22211553
Kissane, C., Krzyzanowski, R., Bloom, I., Conmy, A., and Nanda, N. Interpreting attention layer outputs with sparse autoencoders. arXiv preprint arXiv:2406.17759 2024.
Heng, A. and Soh, H. Selective amnesia: A continual learning approach to forgetting in deep generative models. Advances in Neural Information Processing Systems, 36, 2024.
Kumari, N., Zhang, B., Wang, S.-Y., Y., Shechtman, E.,, Zhang, R., and Zhu, J.-Y. Ablating concepts text-to-image dif- fusion models. In Proceedings of the IEEE/CVF Interna- tional Conference on Computer Vision, pp. 22691-22702, 2023.
Heusel, M., Ramsauer, H., Unterthiner, T., Nessler, B., and Hochreiter, Gans trained by a two time-scale update rule converge local nash equilibrium. Advances in neural information processing systems, 30, 2017.
K Kwon, M., Jeong, J., and Uh, Y. Diffusion models al- ready have semantic latent space. In The Eleventh International Conference on Learning Representations, 2023. URL https: /pwprevieneeeeeeeeeeeeeeeeeeeeee net forum? i @==dd122eBBVE
Ho, J., Jain, A., and Abbeel, P. Denoising diffusion proba- bilistic models. Advances in neural information process- ing systems, 33:6840-6851, 2020.
Lee, B. H., Lim, S., Lee, S., Kang, D. U., and Chun, S. Y. Concept pinpoint eraser for text-to-image diffusion mod- els via residual attention gate. In The Thirleenth Interna- tional Conference on Learning Representations, 2025.
Huang, C.-P., Chang, K.-P., Tsai, C.-T., Lai, Y.-H., Yang, E.-E., and Wang. Y.-.. F. Receler: Reliable concept erasing of text-to-image diffusion models via lightweight erasers. European Conference on Computer Vision, pp. 360-376. Springer, 2024.
Li, S., van de Weijer, J., taihang Hu, Khan, F., Hou, Q., Wang, Y., and jian Yang. Get what you want, not what you don't: Image content suppression for text-to-image diffusion models. In The Twelfth International Confer- ence on Learning Representations, 2024. URL https: // /ppenreview. net/ forum? wewerrummd=zpppphpperpp wwtpid//vpppp/////x...m
Huben, R., Cunningham, H., Smith, L. R., Ewart, A., and Sharkey, L. Sparse autoencoders find highly inter- pretable features in language models. In The Twelfth International Conference on Learning Representations, 2024. URL https::///// wttp:ppwwww.w.ee///ppp net/ Forum? id=F7 id=F76bwRST.er 6bwRSLeK.
Lu, S., Wang, Z., Li, L., Liu, Y., and Kong, A. W.-K Mace: Mass concept erasure in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 6430-6440, 2024.
Hurst, A., Lerer, A., Goucher, A. P., Perelman, A., Ramesh, A., Clark, A., Ostrow, A., Welihinda, A., Hayes, A., Radford, A., et al. Gpt-40 system card. arXiv preprint arXiv:2410.21276, 2024.
Lyu, M., Yang, Y., Hong, H., Chen, H., Jin, X., He, Y., Xue, H. Han, J., and Ding, G. One-dimensional adapter to rule them all: Concepts diffusion models and erasing applications. In Proceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition, pp. 7559-7568, 2024.
Ijishakin, A., Ang, M. I.., Baljer, L.,, Tan, D. C. Fry, H. I.., Abdulaal, A., Lynch, A., and Cole, J. H. H-space sparse autoencoders. In Neurips Safe Generative A/ Workshop 2024, 2024.
jang, N., Kachinthaya, A., Petryk, S., and Gandelsman, Y. Interpreting and editing vision-language represen- tations to mitigate hallucinations. In The Thirteenth International Conference on Learning Representations, 2025. URL id= 94 k4WWoo.
Makhzani, A. and Frey, B. J. k-sparse autoencoders. CoRR, abs/1312.5663, 2013. URL https://api. hwwpaattceccccolaoooor/ooroppppo
Marks, S., Rager, C., Michaud, E. J., Belinkov, Y., Bau, D., and Mueller, A. Sparse feature circuits: Discovering and editing interpretable causal graphs in language models. In The Thirteenth International Conference on Learning Representations, 2025. URL https: /ppenevvie... net: mett/forumiidd 14
Kim, D. and Ghadiyaram, D. Concept steerers: Leveraging k-sparse autoencoders for controllable generations. arXiv preprint arviv:2001. 10026001..906, 2025.

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
Olshausen, B. A. and Field, J. Sparse coding with an over- complete basis set: A strategy employed by vI? Vision Research, 37:331 1997. URL https: /apii. semanticscholar.oo wwtp://rsooooooo.:oo.oc 142208899.
Szegedy, C., Liu, W., Jia, Y., Sermanet, P., Reed, S., Anguelov, D., Erhan, D., Vanhoucke, V., and Rabinovich, A. Going deeper with convolutions. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2015.
Park, Y.-H., Kwon, M., Choi, J., Jo, J., and Uh Y. Un- derstanding the latent space of diffusion models through the lens of riemannian geometry. Advances in Neural Information Processing Systems, (1224129-24149 2023.
Tang, R., Liu, L.,, Pandey, A., Jiang, Z.., Yang, G., Kumar, K., Stenetorp, P.,, Lin, J., and Türe, F. What the daam: Interpreting stable diffusion using cross attention. In Pro- ceedings of the 61st Annual Meeting of the Association for Computational Linguisties ( (Volume I: Long Papers), pp. 5644-5659, 2023.
Paulo, G., Mallen, A., Juang, C., and Belrose, N. Automati- cally interpreting millions of features in large language models. arXiv preprint arXiv:2410.13928, 2024.
Templeton, A., Conerly, T., Marcus, J., Lindsey, J., Bricken, T., Chen, B., Pearce, A., Citro, C., Ameisen, E., Jones, A., Cunningham, H., Turner, N. L.,, McDougall, C., MacDiarmid, M., Freeman, C. D., Sumers, T. R., Rees, E., Batson, J., Jermyn. A., Carter, S., Olah, C., and Henighan, T. Scaling monosemanticity: Ex- tracting interpretable features from claude 3 sonnet. Transformer Circuits Thread, 2024. URL https: / scaling-mann hegarnggmmooeemmniiitttt////eee htmll
Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al. Learning transferable visual models from natural language supervision. In International conference machine learning, pp.
PMLR, 2021.
Rando, J., Paleka, D., Lindner, D., Heim, L., and Tramer, F. Red-teaming the stable diffusion safety filter. arXiv preprint ar XXiv:2210.046110 2022.
Toker, M., Orgad, H., Ventura, M., Arad, D., and Belinkov, Y. Diffusion lens: Interpreting text encoders in text-to- image pipelines. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume I: Long Papers), pp. 9713-9728, 2024.
Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. High-resolution image synthesis with latent diffusson models. In Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition, pp. 10684-10695, 2022.
Wu, J. and Harandi, M. Scissorhands: Scrub data influ- ence via connection sensitivity in networks. In European Conference on Computer Vision, pp. 367-384. Springer, 2024.
Schramowski, P., Brack, M., Deiseroth, B., and Kersting, K. Safe latent diffusion: Mitigating inappropriate degenera- tion in diffusion models. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 22522-22531, 2023.
Wu, J., Le, T., Hayat, M., and Harandi, M. Erasediff: Eras- ing data influence in diffusion models. arXiv preprint 2401::2401 2024.
Schuhmann, C., Beaumont, R., Vencu, R., Gordon, C. W., Wightman, R., Cherti. M., Coombes, T., Katta, A., Mullis, C., Wortsman, M., Schramowski, P., Kundurthy, S. R., Crowson, K., Schmidt, L., Kaczmarczyk, R., and Jitsev, J. LAION-5b: An open large-scale dataset for train- ing next generation image-text models. In Thirty-sixth Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2022. URL https: //openreview net fort://ormmmmm 1d-M3374444 V.sMoY.
Yoon, J., Yu, S., Patil, V., Yao. H., and Bansal, M. SAFREE: Training- free and adaptive guard for safe text- to-image and video generation. In The Thirteenth In- ternational Conference on Learning Representations, 2025. URL https: pestps://openeee http///wppwweeewepeetpppee.e..ep net forum? id=hgTFotBRKI.
Zhang, G., Wang, K., Xu, X., Wang, Z., and Shi. H. Forget- me-not: Learning to forget in text-to-image diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1755- 1764, 2024a.
Sohl-Dickstein, J., Weiss, E., Maheswaranathan, N., and Ganguli, S. Deep unsupervised learning using nonequi- librium thermodynamics. In International conference on machine learning, pp. 2256-2265 PMLR, 2015.
Zhang, Y., Chen, X., Jia, J., Zhang, Y., Fan, C.,, Liu, J., Hong, M., Ding, K., and Liu, S. Defensive unlcarning with adversarial training for robust concept erasure in diffusion models. Advances in Neural Information Processing Systems, 07:36748-36776 2024b.
Surkov, V., Wendler, C., Terekhov, M., Deschenaux, J., West, R., and Gulcehre, C. Unpacking sdxl turbo: Inter- preting mext-to-image models with sparse autoencoders. arXiv preprint arXiv:2410.22366 2024.
12

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
Zhang, Y., Fan, C., Zhang, Y., Yao, Y., Jia, J., Liu, J., Zhang, G., Liu, G., Kompella, R. R., Liu, X., and Liu, S. Unlearncanvas: Stylized image dataset for en- hanced machine unlearning evaluation in diffusion mod- els. In The Tiirty-eight Conference on Neural Informa- tion Processing Systems Datasets and Benchmarks Track, net/ forum?
2024c. URL wtt.ttssspppeeeeeeeeeeeeeee id-t9aThFL11E.
Zhang, Y., Jia, J., Chen, X., Chen, A., Zhang, Y., Liu, J., Ding, K., and Liu, S. To generate or not? safety-driven un- learned diffusion models are still easy to generate unsafe images... for now. In European Conference on Computer Vision, pp. 385 403. Springer, 2025.
13

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
A. Batc SAEs trained for diffusion models
The BatchTopK variant SAEs enables the model to flexibly distribute active features across data batch to achieve better reconstruction performance. Specifically, our SAEs allocate more active latents image patches with detailed content, while less important areas, such as the background, are reconstructed using fewer features. As shown in Figure 10, SAEs distribute active features unevenly across image samples. While most of the distribution centers around mean of 8192 (since k = 32 and each image contains 16 x 16 activation vectors), notable number of samples use significantly fewer or more active features.
Additionally, Figure 11 shows the average number of activated features per image patch. Central regions the image tend have more active features, while background areas have fewer. Interestingly, corners the images also exhibit frequent activations.
Distribution of active latents sample
Mean:
Modian: K192
10
Max 112%6
Prequency
10
10'
10a
5000
6000
7000
5000
9010
1000th
1600
Number of active latents
Figure 10. Number of active features per image sample. We see that SAEs assigns unequal number of active features per sample, signifying that some samples are more important than the others for SAE to obtain good reconstruction error.
Avg. Number of Active Latents per Patch
4.6
Number of Active Latents
4,4
Patch Height
4.0
12
2
10
14
Patch Width
Figure 11. Average number of active features corresponding image patches. Interestingly observe that BatchTopK SAEs trained on activations from diffusion model allocate more active features to reconstruct activation vectors corresponding to central image regions.
14

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
B. Prompts from a validation set for feature score calculation
Below, we present the prompts used in our validation set to gather feature activations for style unlearning. The same prompts are applied each style used in the UnlearnCanvas benchmark. For object unlearning, we use all anchor prompts from the CA work, excluding the "in {style} style" postfixes.
"othic cathedral with flying buttresses and stained glass windows in {style} style."
"A bear dressed as a medieval knight in armor in (style} style."
A bird with feathers as iridescent an oil slick in the sunlight in {style} style."
A butterfly emerging from jeweled cocoon in {style} style."
A cat wearing superhero cape leaping between buildings in (style) style."
A dog wearing aviator goggles piloting an airplane in {style) style."
"A goldfish swimming in crystal-clear bowl in {style} style."
A candle's flame flickering in mysterious old library in {style) style."
"Flower blooming in the middle of a snow-covered landscape in (style} style."
"A frog with croak that sounds like a jazz musician's 's trumpet in {style} style."
"Wild horse galloping across the prairie at sunrise in (style) style."
A man hiking through a dense forest in (style) style."
"Jellyfish floating serenely in deep blue water in {style} style."
"Rabbit peering out from burrow in {style) style."
A classic BLT sandwich toasted bread in (style) style."
"Sea waves crashing over ancient coastal ruins in {style} style."
"Statue of a forgotten hero covered ivy in {style} style."
"Tower soaring above the clouds in (style) style."
A majestic oak tree in a serene forest in (style} style."
"Moonlit waterfall in serene forest in {style) style."
C. Selection of cross-attention blocks to apply SAE
In LLMs, SAEs are typically trained on activations from the residual stream, MLP layers, attention layers (Kissane et al., 2024). Building on recent studies on mechanistic interpretability in diffusion models (Basu et al., 2023; 2024), we apply SAES to cross-attention blocks.
To identify the appropriate blocks for style and object unlearning, we conduct an experiment where each cross-attention block ablated one by one, and the block causing the most significant degradation in the targeted visual attribute (style or object) is selected. Ablation involves replacing the block with identity function. Intuitively, this localizes the block most responsible for generating the analyzed attribute.
Figure 12(a) shows original generated images compared to those with the object block up. 1.1 ablated, while Figure 12(b) demonstrates the effect of ablating the style block up1. 2. Although objects remain visible after ablating the object block, they are significantly more degraded compared to ablations of other blocks. In contrast, ablating the style block almost entirely removes the original style from the image.
15

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
Ablated block: up
Abstractionism
Artist Sketch Blossom Season
Bricks
Byzantine
Cartoon
Ablated block: up_ blocks. Lattentions.
Abstractionism
Artist Sketch Blossom Season
Bricks
Byzantine
Cartoon
Figure 12, Ablation of cross-attention blocks. (a) Ablating the object block up 1 1 notably degrades the quality of generated objects and (b) ablating the style block up. 1.2 almost completely removes the original style of the image.
D. Details of sequential unlearning evaluation
The sequential unlearning evaluation assesses methods in scenario where unlearning requests arrive sequentially. This setup requires methods to progressively remove an increasing number of concepts from a base model while ensuring previously unlearned targets remain unlearned. At the same time, it significantly challenges the retention of the model's overall performance.
To ensure fair comparison, we follow the evaluation protocol from the UnleamCanvas paper. Specifically, we sequentially unlearn the following styles in this order:
1. Abstractionism
2. Byzantine
3. Cartoon
4. Cold Warm
5. Ukiyoe
6. Van Gogh
After each phase, we compute the UA and RA metrics, where RA is the average of IRA and CRA. Figure 13 shows UA averaged over all unlearned concepts up to each phase. SAeUron consistently maintains high unlearning accuracy and significantly outperforms competing methods in retaining the ability to generate all other concepts.
16

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
ESD
FMN
UCB
- CA
SalUn
SPM
BDiff - SHS
Ours
Unlearning Accuracy (UA)
Retention Accuracy (RA)
100
100
80
UA [%)
[%]]
RA RA
0
2
4
2
Number of Concepts
Number of Concepts
Figure 13. Evaluation unlearning multiple concepts. SAeUron achieves high unlearning accuracy and outperforms other approaches
retaining generative capabilities for non-targe non-targeted concepts.
E. SAE trainings details
We train our BatchTopK sparse autoencoders with 32 and an expansionnfactor of 16. Optimization uses Adam (Kingma, 2014) with learning rate of 0.0004 and linear scheduler without warmup. We the batch size 4096 and unit-normalize decoder weights after each training step.
Following heuristics from (Gao et al., 2025), we set kanx power of two close to and a 32- Additionally. in line with Templeton et al. (2024), we consider a latent dead if it has not activated over the last 10M training samples. We train the SAE on the up 1.. object block for 5 epochs and on the up. 2 style block for 10 epochs.
Table 3 summarizes key training hyperparameters and metrics, while Figure 14 presents log feature density plots at the end of training. The SAE trained on up 1. 1 exhibits dead latents, whereas the one trained on up 1. does not. Notably, very few features activate very frequently, which suggests promising interpretability.
Both SAEs were trained single NVIDIA RTX A5000 GPU. Training the SAE on the up 1..1.1 object block took 27 hours and 40 minutes, while training on the up. 1 2 style block required 59 hours and minute.
Feature Density
Feature Density
3000
2500
2000
1500
1500
500
500
-8
-3
-2
-8
-7
-6
-5
-2
-1
Feature Density
Log Feature Density
(a) Log feature density of block up.1.1 1.1
(b) Log feature density of block up. 1.2
Figure 14. Log feature density plots SAEs trained on cross-attention blocks.
17

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
Table 3. Summary of SAE trainings.
Fraction Var.
Learning
Batch
Dead Feature
Normalize
Block
# Latents n
Ot
Unexplained
Rate
Size
Threshold
Epochs
Decoder
up.
20480 20480
32
T
0.181 0.198
0.0004
4096
10M
5
V
up. 1.2
32
0.0004
4096
10M
10
V
32
F. SAE generalization abilities
We assess the generalization of SAEs by training sparse autoencoder on activations from prompts in randomly selected half (25) of the styles in the UnlearnCanvas benchmark. The training setup remains identical to our other SAEs.
To evaluate the ability to unlearn concepts not seen during training, we apply SAeUron to the style unlearning task using this SAE, following the setup in Section 5.3. Table 4 presents results for SAEs trained on half of the styles, evaluating performance on all styles, in-distribution styles, and out-of-distributtin (OOD) styles.
Notably, we achieve over 50% unlearning accuracy on OOD data, demonstrating that SAEs effectively generalize and can unlearn concepts even when they were absent from the training set.
Table 4. Unlearning performance with SAE trained on half of the data.
Setup
UA (t)
IRA (1)
CRA (1)
Avg. (f)
All data
75.00%
90.18%
80.74%
81.97%
In-distribution
99.76%
99.23%
98.48%
99.16%
Out of distribution
51.00%
67.38%
98.36%
72.25%
G. plperpaarsetees for object unlearning
For object unlearning we tune our two hyperparameters: number of selected features T. and multiplier Ye for each class separately. Selected parameters are presented in Table 5.
Table S. Hyperparameters of our method for object unlearning.
Object
Selected features To
Multiplier Ye
Architectures
20
20.00
Bears
10
33.0
Birds
20
10.0
Butterfly
3
-1500
Cats
1
15.00
Dogs
2
20.00
Fishes
33.0
Flame
25.0
Flowers
20
20.0
Frogs
5
-5.0
Horses
25
25.00
Human
25
20.0
Jellyfish
25
-15.0
Rabbits
-3000
Sandwiches
20
-15.0
Sea
33.0
Statues
20
-30.0
Towers
25
20.00
Trees
30
25.0
Waterfalls
30
-30.0
18

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
H. Activation steering style features
further explain what information encoded by our SAE as individual features with the highest correspondence to a concept To that end, we generate unconditional examples using diffusion model (using an empty prompt) and steer the generation process by increasing activations of the highest scoring features for given concept. Specifically, modify feature maps F; during forward pass of the diffusion model at each timestep t in the following manner.
Σ mti (,),,, iEF
where d, is feature direction corresponding i-th column of SAE decoder, 7 R. is concept-speeific positive multiplier that determines the strength of steering and F. == {i E Top-Te (op-Te((scorettkk c, D)})} is set of chosen features. In Figure 15 we demonstrate that such steering results in generations that exhibit visual attributes corresponding to specific artistic styles. This evidences strong correspondence of features with these styles and thus supports the effectiveness of our feature localization method.
Reference Image
Without
With
Steering
Steering
Picasso
Abstractionism
Superstring
Pastel
Color
Fantasy
Figure 15. Steering unconditional generations with features selected using cosee method. Features associated with specific styles effectively produce generations that visibly reflect those styles.
19

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
I. K-nearest neighbors classification for style features
conduct an analogous experiment to one in Section 5.2.1, this time on style features. Figure presents the results. Notably, both the ccore-based and random feature setups use only a single feature, as our selection method identifies only one feature for style unlearning.
Interestingly, accuracy remains similar between using all features and the score-based selection. Moreover, accuracy tends to increase from approximately the 30-th timestep, suggesting that style-related features emerge later compared to object-related features in the classification setup.
100
Score-based selection
All features
Random features
Accuracy [%)
Random guess
60
40
2
100
80
60
40
20
Timestep
Figure 16. Style classification with k-nearest neighbors algorithm based on SAE feature activations.
J. Distribution of feature importance scores across timesteps
We analyze how the distribution of score importance varies across denoising timesteps. Figure 17 shows two high percentiles of score distributions over all 100 timesteps. We observe that the threshold value decreases as the generation process progresses, indicating that more features receive high scores early denoising. As the process continues, only a small number of features remain highly relevant to specific concepts.
99. 99,999th Percentile
0.10
99.995th Percentile
Threshold Value
0.08
0.06
0.04
0.02
100
80
60
40
20
Timestep
Pigure 17. Percentiles score distribution across denoising timesteps.
20

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
K. UnlearnDiffAtk evaluation of object unlearning
also evaluate our method on adversarial prompts crafted using the UnlearnDiffAlk method for object unlearning. As shown in Figure 18, unlearning accuracy drops significantly under attack. However, this largely due the nature of the evaluation process, where each iteration of UnleamDiffAtk determines attack success based on the classifier's argmax prediction.
As demonstrated in Figure 19, SAeUron completely removes the targeted object from the image. However, since other object replaces it, the classifier's predictions become largely random. Consequently, attacks are often marked as successful, even when they fail to make the model generate the unlearned object.
To further validate whether images before and after the attack resemble the targeted object, we compute CL CLIPScore (Radford al., 2021) between the target object's name and the image. As shown in Table 6, the CLIPScore remains nearly unchanged. indicating that the attack rarely leads to generating the targeted object.
Before UnlearnDiffAAtk
After UnlearnDiffAtk
100
Unlearning Accuracy [%)]
80
60
20
ESD
FMN
UCE
CA
SalUn
SEOT
SPM
EDiff
Figure 18. Robustness to adversarial prompts crafted using UnlearnDifTAtk method on object unlcarning.
Table CLIPScore between images and targeted objects before and after the attack. Although the attack is successful, the similarity to the target object barely changes.
CLIPScore (L)
Before attack
0.2329
After successful attack
0.2403
21

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
Before Attack
After
Attack
Architectures
Flame
Trees
Statues
Figure 19. Effect of UnlearnDiffAtk object unlearning with approach. The left column shows images generated with SAeUron. where the object should be unlearned, while the right column presents results after the adversarial attack. Despite the attack's success, the targeted object remains absent from the image.
L. Adversarial attack evaluation for nudity unlearning
We run additional comparisons with adversarial attacks using the 143 nudity prompts provided by the authors UnlearnDif- fAtk as a benchmark. As presented in Table 7, SAcUron outperforms even the methods specifically designed for robustness against adversarial attacks.
In this setup Pre-ASR and Post-ASR are Attack Success Rates of nudity generation from the official UnlearnDiffAtk Benchmark. Both metrics measured based on the same set of predefined 143 prompts generating nudity in the base SD-v1.4 model. Pre-ASR measures the percentage of nudity generated by the unlearned evaluated model. In the Post-ASR scenario, each prompt is additionally tuned in an adversarial way by the UnlearDDiffAtk method to enforce the generation of nudity content. Substantial differences between those two metrics for some methods witness the fact that they are highly vulnerable to this type attack. Notably, our method achieves Post-ASR of 1.4%, yielding the smallest difference between Pre and Post ASR.
22

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
Table Attack Success (ASR) before after UnlearnDiffAtk on nudity prompts. Our method is robust against ad adversarial
attack.
Method
Pre-ASR
Post-ASR
FMN (Zhang al., 2024a)
88.03
97.89
SPM (Lyu et al., 2024)
54.93
91.55
SAFREE (Yoon et al., 2025)
26.06
85.59
UCE (Gandikota et al., 2024)
21.83
79.58
ESD (Gandikota et al., 2023)
20.42
76.05
RECE (Gong et al., 2024)
13.38
75.42
MACE (Lu et al., 2024)
9.10
74.57
AdvUn (Zhang et al., 2024b)
7.75
21.13
SalUn (Fan et al., 2024)
1.41
11.27
SHS (Wu & Harandi, 2024)
0.00
7,04
Erasediff (Wu et al., 2024)
0.00
2.11
SAeUron
0.00
1.40
M. Unlearning features selection examples
In this section, we provide additional examples of features selected for unlearning of specific objects different timesteps:
The Most Important Features for "Bears" Unlearning
Feature 10400
Feature
Feature
Feature 14445
Feature
Timestep
Feature 10400
Fealurro 19324
Feature 14445
Feature 19554
Festure 18875
Timestep 30
Fenuure Activition
Fcature 10400
Feature 19324
Feature 18875
Feature 14445
Feature 14995
Timestep 10
10400
18875
14465
Timestep
60
Figure 20. The most important features for Bears unlearning according to score-based approach across timesteps. Features sorted by importance in each row from left to right. Additionally, we display normalized feature activation to showcase the interpretability of features.
23

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
The Most Important Features for "Dogs" Unlearning
Feature 17704
Fenture 3227
Feature 2409
8553
Fenture 2690
1.5
Timestep 47
Timestep 30
Teestuee Activaiio
Feature 2409
Fenture 12029
Festure 17704
Feature 16052
Fenture 9652
Timestep
Feature 2409
Fenture 12029
Feature 17704
Feature 16012
Feature 9652
Timestep
Figure 21. The most important features for Dogs unlearning according to our score-based approach across timesteps. Features are sorted importance in each row from left right. Additionally, we display normalized fcature activation showcase the intcrpretability of features.
The Most Important Features for "Rabbits" Unlearning
Feature 14130
Fenture 6610
Feature 18584
Feature 9710
Feature 6097
Timestep 47
Penture 14130
Posture 18584
Fosture 6610
Feature 11524
Feature 9710
0,3
Timestep 30
Souunn V Saalhnnne
11524
Feature
Timestep
Fenture 14130
Festure 18584
Festure 6610
Festure 1813
Fearure 11524
Timestep
Figure The most important features for Rabbits unlearning according to our score-based approach across timesteps. Features are sorted by importance in each row from left to right. Additionally, we display normalized feature activation to showcase the interpretability features.
N. Unlearning time vs. performance evaluation
To showcase the efficiency of our approach, we measure the time needed to achieve the desired unlearning performance in Figure 23. We evaluate the scaling of the SAeUron approach using the training set of sizes: 100, 200, 500, 750, and 1000 images. We train our SAE for 5 epochs for each scenario, keeping the hyperparameters constant. Our approach achieves good unlearning results even in limited training data scenarios while being more efficient from all methods requiring
24

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
fine-tuning.
ESD
CA
EDiff
FMN
SalUn
SHS
UCE
SEOT
SAcUron
Average Score
Train
100
1000
200
500
750
1600
Average Score (%)
90
80
60
10
10
10
Total Unlearning Time (seconds)
ESD
FMN
UCB
CA
SalUnn
SEOT
EDHT
SHS
SAcU/ron
UA
IRA
CRA
100
100
160
Accuracy (%)
Accuracy (%)
Accuricy (%)
80
80
8.0
60
60
60
50
40
10"
Total Unleaming Time (scconds)
Total Unleaming Time (scconds)
Total Unleaming Time (scconds)
Figure 23, Comparison of total time needed for style unlearning across methods. We evaluate SAeUron across 5 different sizes of SAF training sets, demonstrating its scalability and high performance with highly limited data, At the time, all setups of approach perform unlearning more efficiently than most methods.
25

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
O. Limitations of SAeUron
The main limitation of our method regarding the unlearning performance can be observed in a situation where two classes unlearned and remaining ones, share high similarity. In such cases, we might also ablate features that are activated for the remaining class. To visualize this issue, we present generated examples the dog class while unlearning the cat class and vice versa in Figure 24. Observed degradation is mainly due to the overlap of features selected by score-based approach during initial denoising timesteps (Figure 25). To further investigate this issue, in Figure 26 we visualize overlapping features. The strength of using SAEs for unlcarning is that we can interpret the failure cases of our approach in this case overlaped feature is related to the generation of heads of both animals. During later timesteps, our score-based selection approach is mainly effective and features that either do not activate at all on the other class or activate with a much smaller magnitude (Figure 27 and Figure 28).
"Cats"
"Dogs"
Original
"Dogs" unlearning
"Cats" unlearning
Figure 24. Impact of Cats and Dogs unlearning on each other. Due to partially shared features selected for unlearning, we observe a degrading impact of unlearning. Dogs unlearning particularly negatively impacts the quality of generated Cats.
Feature Overlap Between Cats and Dogs Across Timesteps
1.0
Number of Overlapping Features
0.4
0.2
100
71
61
31 Timestep
41
31
21
Figure 25. Number of overlapping features selected for unlearning of Dogs and Cats. During the first 10 denoising timesteps there a
feature that is selected by acore-based approach for unlearning of both classes, We show activations of this feature in Fig. 26.
26

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
"Cats"
*Dogs*
Timestep 99
Timestep
Timestep 94
Timestep 90
Figure 26. Activations of overlapped feature 17704 during the first denoising steps. Feature is related to the generation of the head of both animals.
"Cats" Features
Timestep 95
Timestep 65
Timestep 25
Timestep
Figure 27. Activations of features selected for unlearning of Cats during generation of Cats and Dogs. Selected features do not activate on a Dog examples at all, or with notably smaller magnitude.
27

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
"Dogs" " Features
Timestop 95
PARK KINN
NAW DEP Eay AUTET PA
Timestep 65
Timestep
Timestep
Figure 28. Activations of features selected for unlearning of Dogs during generation of Cats and Dogs. Selected features do not activate on Cat examples all, with notably smaller magnitude.
28

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
0.1. Unlearning of abstract concepts
To assess how SAcUron performs unlearning broad and more abstract concepts, we evaluated its performance on the full I2P benchmark. Following prior works, use the Q16 detector to assess whether generated image contains inappropriate content. The results presented in Table 8. We observed that, compared to other benchmarks, method underperforms on this one, performing on par only with the FMN method.
We attribute this outcome to the fact that in SAeUron, we train the SAE on internal activations of the diffusion model. As result, the learned sparse features correspond to individual visual objects, such as cat cars or whiskers. Thus, while our method effectively removes well-defined concepts composed of visual elements (e.g., nudity blood), it struggles capture abstract notions like hate, harassment, violence.
Table 8. Inappropriate content unlearning evaluation. Following Schramowski al. (2023) and Huang et al. (2024), present the ratio of inappropriate content as a meric. The best result for each metric is highlighted in bold.
Method
Hate (1)
Harassment (1)
Violence (1)
Self-harm (1)
Shocking (1)
Illegal Activity (1)
Overall (1)
CLIPScore (1)
FID (L)
FMN (Zhang al., 2024g)
37.7%
25 15.0%
47.8%
46.8%
58, 1%
37.0%%
45,4%
30.39
13.52
SLD-M [Schramowski al., 2023)
22.5%
22. 1%
31.8%
30.0%
10,5%
22.1%
28, 28.2%
30.90
16.34
RSDxx (Gandikkta et al., 2023)
26.8%
24.0%
35.1%;
33.7%
40.1%
26.7%:
31.1%
30.69
14.41
UCE (Gandikora al,, 2024)
36.4%
29 5%
34.1%
30.8%
11%
29.0%
33.5%
30.85
14.07
Receler (Huang
28.6%
27.1%
SAeUron
45.4%
40.7%
46.9%
41.57%
53.9%
36.3%
44.6%
30.45
15.08
P. Qualitative comparison against other methods
In Figure 29 and Figure 30, we present a qualitative comparison with the best-performing contemporary techniques. In the first set of plots, we show how SAeUron can remove the Bloosom Season style while retaining the original objects and the remaining styles. This not the case for the other approaches that often fail to generate more complex classes like statues or the sea. At the same time, our technique can unlearn the Dogs class without affecting the remaining objects all of the evaluated styles.
29

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
Unlearning target: "Blossom Season" "
Test prompt: "An image of (object) in Blossom Season style."
unlearning
ESD
FMN
SalUnn
CA
SAeLiron
Bears
Unlearning Effectiveness Evaluation
Butterlly
Cats
Fishes
Frogs
Horses
Rabbits
Test prompt: "An image of Dogs in [style] style."
In- De-Domain Retainability Evaluation
Abstractionismm
Artist Sketch
Byzantine
Bricks
Test prompt: "An image fobject)." "
Cross- Domain Retainabllity Evaluation
Statues
Sea
Sandwiches
Human
Flame
Figure 29, Qualitative comparison with other methods on style unlearning.
30

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
Unlearning target: "Dogs"
Test prompt: "An image of Dogs in (style] style."
unlearning
ESD
FMN
SalUn
CA
SAcUron
Unlearning Effectiveness Evaluation
Winter
Vibrant Flow
Van Gogh
Superstring
Test prompt: "An image of [object)."
Do-Domminn Retainability Evaluation
Statues
Sea
Sandwiches
Human
Cats
Test prompt: "An image (object) Color Fantasy style."
Cross- Dommin Retainability Evaluation
Cats
Frogs
Birds
Jellyfish
Towers
Figure 30. Qualitative comparison with other methods object unlearning.
31

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
Q. Hyperparameters selection
As stated in Section 5.3, we tune hyperparameters our validation set. Here, we evaluated multiple values for the multiplier and the number of features selected for unlearning, As shown Figure Figure 31 of additional results, our method is robust these parameters, with a broad range of values (apart from extreme cases) yielding comparably high performance.
517
63.3
61.3
22.0
153
5.7
13
$8.5
38
38
55
96.5
56.5
963
95.9
97.0
97.0
94.2
96.7
00.0
44
72.3
63.0
63.0
53.0
43.7
55.0
1.7
$7.5
98.6
38.6
55.5
96.7
98.5
98.8
95.4
95.8
95.0
95.6
97.0
95.4
99.0
50
73.0
68.3
12.0
95.7
Topsk
Scarc 050
78.3
143
15.3
75.0
723
92.0
25-7
S4.
16.5
91.7
92.2
91.3
99.2
97.
19.0
R-
78.9
78.3
15.7
98.7
145
757
8.7
R
53.3
$1.2
10
9IA4
9222
M2.7
949
90.4
57.
96.9
4
92.4
98
9165
95.5
20
78.7
92.7
91.2
97.0
350
230
1550 Miltiplier
-100
-3.
00
-562
-2..
-25.0
-15.0 Miltipierr
-120
-.00
0.0
-300
-230
-35 Multiplier
-10M
-5.
Figure 31. Evaluated metries for unlcarning of classes Cats, Dogs and Towers with different number of selected features and multiplier.
32

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
R. Detailed performance evaluation
To measure the impact unlearning on other concepts in Figure we present accuracy on each of 20 classes from UnleamCanvas benchmark during unlearning. For most classes, our method successfully removes the targeted class while preserving the accuracy of the remaining ones. Nonetheless, in some cases where classes are highly similar to each other (e.g., Dogs and Cats), removing of them negatively impacts the quality of the other. This observation is consistent across evaluated methods presented in appendix D.3 of the original UnlearnCanvas benchmark paper.
Impact of Unlearning on Class Accuracy
100
Architactures-
6.4
100.0
84.8
99.4
100.0
99.6
99.6 100.0
100.0
95.8
99.6
99.4
100.0
100.0
80.6
30.6
100.0
100.0
Bears
99.2
3.2
92.4
100.0
88.8
99.8
99.2 99.6
99.6
96.6
99.2
86.4
99.8
99.6
100.0
99.8
91.2
93.8
99.8
100.0
99.8
100.0
100.0
Bulterdyy
99.6
100.0
91.8
53.4
99.6
100.0
99.6
100.0
LO0.0
97.2
100.0
95.2
99.8
99.8
100.0
99.8
91.6
94.0
99.8
100.0
80
Cate
99.4
100.0
84.
100.0
1.6
0.8
99.6
99.6
99.6
97.8
10H0.
94.
9996
3:00
180.0
99.8
92.6
92.6
100.0
100.0
Dogs
Fishes-
99.4
99.8
9000
99.8
99.4
100.0
2.6
99.6
99.6
10.6
1000.1
95.6
199
4.6
100.0
99.8
92.4
X2.
99.8
100.0
Flame
99.6
100.0
95.4
99.8
99.8
100.0
99.8
12.8
100.0
96.8
100.0
86.2
99.8
99.8
99.8
99.6
92.6
$2.4
99.6
100.0
60
Flowers
99.2
100.0
84.6
100.0
100.0
99.4
99.8
23.8
97.4
100.0
94.8
99.8
99.6
100.0
100.0
91.6
91.8
10000
100.0
Frogs
99.8
99.8
82.2
100.0
99.0
100.0
48.8
99.4
100.0
0.0
100.0
95.0
99.6
54.6
100.0
99.6
91.6
94.2
99.6
100.0
Unleamce
100.0
96.8
100.0
99.2
10.8
99.6
Human
99.8
100.0
96.4
99.6
99.6
100.0
99.6
99.8
99.8
97.2
100.0
91.4
100.0
99.8
100.0
100.0
88.6
93.4
99.8
100.0
40
Jellyfish-
99.4
100.0
X4.2
99.8
99.4
100.0
99.4
100.0)
99.
96.4
1000.8
95.6
0:00
100.0
180.0
100.0
92.2
99.9
100.0
100.00
Rabbits
Sandwiches
98.8
100.0
74.2
99.8.
99.6
100.0
98.6
99.4
99.6
95.4
100.0
96.0
90.0
99.8
0.0
99.6
91.6
92.0
99.8
100.0
Sea 99.6
100.0
86.2
100.0
99.4
100.0
99.6
99.8
100.0
97.2
100.0
86.2
99.8
99.8
100.0
22.2
92.2
$3.8
100.0
99.8
20
Statues
95.2
99.8
93.8
99.8
100.0
99.2
100.0
99.6
100.0
95.8
99.8
100.0
99.8
73.0
99.4
99.8
100.0
Towers:
94.2
100.0 11
80.2
99.8
98.8
100.0 99.6
9X.
999
9X.0
1000.
71.8
100.0)
999.8
100.0
98-4
91.4
50.0
9996
99
100.0
10000
(10.0)00
99.2
Waterfalls
99.6
99.8
84.0
100.0
99.4
100.0
99.4
99.8
99.8
97.8
100.0
86.0
99.8
99.8
100.0
99.6
92.4
93.6
99.6
5.6
Archtrectaryy
Bom
Binds
Buterily
Cate
Doge
Fishor
Flome
Floworg
Frogs
Horwy
Human
Jollyfid
Rabbite
Sanfwrcher
Sea
Statuce
Toware
Trea
Watorfalle
Evaluated Class
Figure 32. Impact on classification accuracy of classes during unlearning, Unlearning of similar classes, such Cats and Dogs. negatively impacts other. Complicated classes, such as Human, are harder to be effectively removed.
33

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
S. Pseudocode of SAeUron
For ease of understanding our unlearning procedure, we present detailed pseudocode SAeUron applied on a single denoising timestep t in Algorithm 2.
Algorithm Prepare for unlearning
1: Input: concept timestep t, dataset D, number of features Te, SAE width
2: F - {i] Top-Te( (op-Te((scom))) ((scoreei,, t, D)))
3: m(i) t D)) Vi Fe
4: Output: Fe.
Algorithm 2 SAeUron unlearning method for DMs
1: Input: target concept c, denoising timestep I, validation dataset D, number of features To: multiplier %
2: F E Rexxxxd f- feature map from cross-attention block
3: pdla R((xw)xdd Flatten(FF))
4: Ffl t- -Ffiat
5: Fe, lt < -rrepareec,,,
6: for jrj= = 11o (h w) do
7: x() -F(b []
8: 2(1) 2. + TopK W emc (x(1) 5) bpre))
9:
for all E Fe do
if (3) > ue then
20) + %c (i,,,, 2(13
11:
12: end if
13:
end for FA
[J] Waec 2(5) ppre + (z()) 2(0)
end for
16: P. Reshape [ittat (h, w. d))
17:
Output: Fg < modified feature map with removed c
T. Auto-interpreting features selected for unlearning
To validate whether the features selected by our score-based method correspond to meaningful and interpretable concepts, we construct simple annotation pipeline using GPT-4o (Hurst et al., 2024). To achieve this, we design a prompt for the GPT model, closely following the one presented in (Paulo et al., 2024) and adapting it to our case. Below, we present this prompt:
You are meticulous researcher conducting an important investigation into vis visual patterns and feature activations. Your task is to analyze two sets of images and provide an explanation that thoroughly encapsulates the visual features that trigger a particular activation.
You will be presented with two rows of image examples:
Row 1: Original Images (Context). This row contains original images. These images provide the visual context for the feature analysis.
Row 2: Activation Overlay Images (Feature Activation). This contains 5 images. Each image in this row corresponds to the image directly above it in Row 1, but with visual overlay. The overlay marks specific regions where a particular feature is strongly activated in the correspending original image.
Your goal is to produce a concise, final description that summarizes the shared visual features and patterns you observe the highlighted regions of the Row
34

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
(Activation Overlay Images), while using the Row (Original Images) for context. Please adhere the following guidelines:
Focus on summarizing the visual pattern of activation: Describe the overarching visual features common to the highlighted areas in the Row 2 (Activation Overlay Images). Identify and explain the visual patterns you discern within these overlayed regions. Do not simply describe the entire images in Row or Row 2, but specifically analyze what visual elements within the activated overlays in Row 2, when seen in the context of the corresponding original images in Row 1, indicate the feature is detecting.
Utilize Context from Original Images: Refer to the Row (Original Images) to understand the objects, scenes, or visual elements present in the areas where the feature is activated in Row 2. The original images provide crucial context for interpreting the feature.
concise: Keep your final explanation brief and to the point. The explanation should be single, concise sentence.
Ignore uninformative examples: If some image pairs or their overlays seen unclear or do not contribute to identifying visual pattern, you may disregard them in your explanation.
Omit marking details: Do not mention the specifics of the visual marking (e.g., "red overlay," " "highlighted pixels"). Focus solely on the visual content of the activated regions in Row and describe only the visual content of the activated regions.
Single explanation: Provide only one concise explanation, not a list of possible explanations.
Formatted output: The very last 1ine of your response must be the formatted explanation, beginning with [EXPLANATION] followed by your concise explanation.
Analyze the following two Activation Overlay Images) and provide your formatted explanation:
of images (Row 1: Original Images, Row 2:
Alongside the prompt, we provide the GPT-4o model with images from each class in 10 randomly selected styles. The model generates feature annotations separately for each style. Figure 33, Figure 34, and Figure 35 visualize feature activations alongside generated annotations for different objects. As seen in the provided annotations, GPT model successfully identified the visual features corresponding to the targeted concepts.
35

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
(a) Generated annotation: "The activations are strongly triggered by the facial features and eyes the rabbits."
(b) Generated annotation: "The feature activates in regions corresponding to the rabbits' facial features and ears, suggesting focus these distinct animal characteristies."
(c) Generated annotation: "The activation overlays predominantly highlight the facial features and car regions of the rabbits, indicating the model is detecting distinct facial and car characteris- tics."
Figure Activations of selected features Rabbits unlcarning with their annotations generated by the GPT model.
36

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
(a) Generated annotation: "The activated regions consistently highlight branching structures typical of tree tops, indicating feature detecting intricate patterns branches."
(b) Generated annotation: "The feature activation highlights the central shape and structure of the tree tops, focusing on the dense and rounded clusters foliage."
(c) Generated annotation: "The activations consistently highlight the vertical and branching structures of trees, capturing contrast between tree trunks and foliage various lighting conditions."
Figure 34, Activations of selected features for Trees unlcarning with their annotations generated by the GPT model.
37

---

SAcUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders
(a) Generated annotation: "The feature activation emphasizes vertical flows and streaming pat- terns resembling waterfalls, highlighting their smooth, elongated shapes and cascading movements against a textured background."
(b) Generated annotation: "The feature activation consistently triggered by elongated vertical flow and white foamy appearance typical of waterfalls in the images."
(c) Generated annotation: "The visual pattern of activation corresponds the vertical flow cascading movement of water in waterfalls, highlighted by the contrast between the bright water streams and the darker, textured background."
Figure 35. Activations of selected features for Waterfalls unlcarning with their annotations generated by the GPT model.
38


Reviews:
[{"review_id": "WQsDiUTonh", "reviewer": "Reviewer_WhaF", "summary": "The paper proposed a method of unlearning, i.e., erasing concepts as conditional prompts, in diffusion models. The idea is to represent the concept features in a sparse auto-encoder to compress them into low dimension, then modifies the weights of concept-related features after detecting them, leading to modified generative outputs.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for the positive review of our work, below we would like to explain and address the comments and remaining weaknesses with the help of additional tables and figures provided in the anonymized link [Anonymous github](https://anonymous.4open.science/r/saeuron-8D02/saeuron_rebuttal.pdf):\n\n\n>The weak point is that the distinctive idea between the proposed method versus existing ones is not clear stated.\n\nThank you for pointing out this limitation; we will emphasize the distinctiveness of our method when compared with existing solutions in the final version of our submission. Below, we briefly outline the key differences.\n\nMost existing approaches to machine unlearning in diffusion models (e.g., EDiff, ESD, FMN, SalUn, SHS, SA, CA) follow a common principle: fine-tuning the pre-trained model to unlearn a specific concept while either constraining weight updates or replaying the remaining dataset to prevent degradation. In contrast, our method takes a fundamentally different approach. Instead of fine-tuning, we train a single Sparse Autoencoder (SAE) on the activations of the pre-trained model. We then identify sparse features associated with the unwanted concepts and block them to prevent their generation. To our knowledge, this is the first method to introduce such an approach.\n\nOur distinctive idea brings several benefits compared to recent approaches:\n- We demonstrate its effectiveness in unlearning styles and objects and further validate its practical utility by applying it to nudity unlearning (see Table 2 of additional results). \n- Due to the inherent nature of SAEs, the features selected for unlearning are highly interpretable (see Figures 3–8), enhancing the transparency of our approach. \n- Because our method blocks sparse and highly selective features, intervening on activations of a model, it is robust against adversarial attacks and can be used to unlearn multiple concepts at the same time (up to 49 out of 50 available styles, as presented in Table 4). \n\nThose properties distinguish SAeUron from existing solutions in terms of capabilities.\n\n>When talking about unlearning, a key issue is whether the erasing affects other output, especially similar concepts or objects. The paper has mentioned retention accuracy in the appendix but did not clearly state the evaluation criteria and the meaning of the results. Please elaborate it.\n\nWe fully agree that retaining the remaining concepts is crucial for any unlearning method. This is why, in our studies, we employ the UnlearnCanvas benchmark designed to specifically measure not only the effectiveness of unlearning but also the retention accuracy. In particular, in Table 1, presenting the main results for different unlearning methods, we include the *In-domain retain accuracy (IRA)* that measures the quality of generation of other concepts when unlearning a particular one (e.g., 49 other styles when unlearning a single one), and *cross-domain retain accuracy (CRA)* which assesses the retention quality in a different domain (e.g., in style unlearning, we calculate object classification accuracy). As visible, our approach achieves state-of-the-art performance on those metrics in style unlearning and very high results for the object unlearning.\nTo further strengthen our analysis of retention accuracy during unlearning, Fig 9 of additional results presents accuracy on each of the 20 classes from the UnlearnCanvas benchmark during unlearning. In general, our method successfully removes targeted classes while preserving the accuracy of the remaining ones. Nonetheless, in extreme cases where classes are highly similar to each other (e.g., Dogs and Cats), removing one of them negatively impacts the quality of the other. This observation is consistent across evaluated methods as presented in appendix D.3 of the original [UnlearningCanvas benchmark](https://arxiv.org/abs/2402.11846).\n\nTo further evaluate the retention capabilities of our approach, **we run an additional experiment with an extreme scenario where we unlearn 49 out of 50 styles present in the UnlearnCanvas benchmark** (leaving one style out to evaluate the quality of its preservation). We observe almost no degradation in SAeUron performance for three randomly selected combinations. **For unlearning of 49/50 styles simultaneously, we observe UA: 99.29%, IRA: 96.67%, and CRA: 95.00%**. Those results highlight the unprecedented degree of unlearning precision with SAeUron.\n\nWe are happy to discuss any other issues or questions regarding our paper. If there are none, we would highly appreciate you considering raising the score.", "claims_and_evidence": "The authors carried out experiments to demonstrate the efficiency of erasing concept-based objects from images, and compare them with previous erasing (unlearning) methods.", "methods_and_evaluation_criteria": "The evaluation criteria and benchmarks makes sense.", "theoretical_claims": "No theoretical analysis provided.", "experimental_designs_or_analyses": "Yes.", "relation_to_broader_scientific_literature": "N/A", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "The strong point is that the paper have compared their method with a significant number of recent methods. The weak point is that the distinctive idea between the proposed method versus existing ones is not clear stated.", "other_comments_or_suggestions": "N/A", "questions_for_authors": "When talking about unlearning, a key issue is whether the erasing affects other output, especially similar concepts or objects. The paper has mentioned retention accuracy in the appendix but did not clearly state the evaluation criteria and the meaning of the results. Please elaborate it.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "EaWSd3AT95", "reviewer": "Reviewer_gT3h", "summary": "This paper introduces SAeUron, a novel method for concept unlearning in diffusion models by manipulating intermediate features using Sparse Autoencoders. The Sparse Autoencoder is trained to learn representations where most features have near-zero values, allowing specific concept-related features to be identified. The autoencoder's input consists of intermediate UNet features extracted at certain timesteps during diffusion.\n\nAfter training is complete, the activated features corresponding to a specific concept (e.g., a class) are identified. During inference, the unlearning process is applied by negating only these specific feature values. The modified features are then passed through the decoder of the Sparse Autoencoder, altering the features of the U-Net to effectively suppress the generation of the targeted concept.\n\nOn the UnlearnCanvas benchmark, SAeUron outperforms existing unlearning baselines in style unlearning and achieves comparable results in object unlearning. Additionally, it offers two key advantages over other methods: i) Sequential Unlearning – It performs well when unlearning multiple concepts in sequence. ii) Robustness to Adversarial Prompts – It effectively resists adversarial prompts crafted using the UnlearnDiffAtk method.\n\n## Final recommendation and Justification (post rebuttal)\n\nThank you for addressing my concerns and answering the questions. The underperformance of SAeUron on broader concepts (e.g., hate) and the degradation of dogs when unlearning cats make sense, and I agree that it's valuable to highlight this in the discussion or limitations section.\n\nThe additional experiments presented in the rebuttal have strengthened the paper with a more thorough analysis. I expect the authors to include all of these insights in the camera-ready version. I’m happy to raise my score to Weak Accept.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Link to additional tables and figures: [Anonymous github](https://anonymous.4open.science/r/saeuron-8D02/saeuron_rebuttal.pdf)\n> **Unlearning of nudity** \n\nTo highlight the potential of SAeUron in real-world applications, we extend our study to the evaluation with the I2P benchmark focusing on the real-world application of NSFW content removal (see reply to rev 8z9i for technical details). As presented in Table 2, SAeUron achieves the best score in nudity content removal while maintaining high-quality generations for the remaining concepts.\n\n>**Lack of qualitative comparisons with baselines**\n\nIn Fig 1 and Fig 2, we present a qualitative comparison with the best-performing contemporary techniques. In the first set of plots, we show how SAeUron can remove the *Cartoon* style while retaining the original objects and the remaining styles. This is not the case for the other approaches that often fail to generate more complex classes like statues or the sea. At the same time, our technique can unlearn the bear class without affecting the remaining objects or all of the evaluated styles.\n \n>SAeUron only achieves the best score in (IRA) and average performance of style unlearning. This does not fully support the claim that SAeUron achieves state-of-the-art results.\n\nThank you for pointing out the inaccuracy; we will rewrite the sentence in the final version of our paper to highlight that our approach yields state-of-the-art results for style unlearning while scoring the second-best score for objects. The evaluation metrics are designed in a contradictory way, so it is easy to improve on one metric at the expense of another. Therefore, we report the average performance across all three metrics to enable a fairer comparison among all evaluated methods.\n\n>**Performance against adversarial attacks**\n\nAs requested, we run additional comparisons with adversarial attacks using the 143 nudity prompts prvided by the authors of UnlearnDiffAtk as a benchmark. As presented in Tab 3, **SAeUron outperforms even the methods highlighted by the reviewer as specifically designed for robustness against adversarial attacks.**\n\n>Selection of the targetted block\n\nThe selection of the appropriate activations for applying SAE is a critical decision. To simplify this process, we introduce a straightforward methodology in which we ablate the diffusion blocks one by one to identify the one essential for generating the desired concepts, as detailed in Appendix C. Although this heuristic may not always pinpoint the optimal location for the SAE application, it allowed us to achieve high-quality results.\n\n> Choice of hyperparameters\n\nAs stated in Section 5.3.2, we tune hyperparameters in our validation set. Following the reviewer’s suggestion, we evaluated multiple values for the multiplier $\\gamma$ and the number of features selected for unlearning (instead of percentile $\\tau$, to make the analysis clearer). As shown in Figure 10 of additional results, our method is robust to these parameters, with a broad range of values (apart from extreme cases) yielding comparably high performance.\n\n\n> **Method Efficiency** Methods like SLD or Receler do not require additional training or require only lightweight training, whereas SAeUron involves learning whole autoencoder networks, which may introduce overhead?\n\nWe would like to point out that sparse autoencoders used by our method are simple linear models consisting of two matrices. Therefore, their training can be considered lightweight. To prove those claims, in Fig 11 and 12, we compare the unlearning time for different approaches with their scores. We evaluate SAeUron with different training set sizes, showing that our method is faster than almost all evaluated approaches while yielding higher performance as measured by the averaged score. \n\n> **Generalization to OOD**: What specific properties of SAeUron contribute to its robustness in OOD scenarios? Furthermore, how do other benchmark methods perform under the same experimental setup?\n\nIn this scenario, we train Sparse Autoencoder on the limited set of styles available in the UnlearnCanvas dataset. Then, we unlearn OOD styles not seen by the SAE during training. This could be understood as a variant of *zero-shot unlearning* where we select features to block only from those already available in SAE without any additional training. Since SAEs are trained in an unsupervised way, they learn an overcomplete set of features, activating also on samples not presented to the model during training. This is in contrast to other methods, where targets need to be explicitly provided during finetuning. As presented in Tab. 3, our method can still achieve 51% unlearning accuracy, with a limited drop in retention accuracy. To our knowledge, none of the evaluated methods could be directly used in such a scenario. \n\nWe hope our responses have clarified your questions and addressed any concerns. If so, we would appreciate your consideration in raising the score.", "claims_and_evidence": "The authors state, \"Evaluation with the competitive UnlearnCanvas benchmark on object and style unlearning highlights SAeUron’s state-of-the-art performance.\" However, Table 1 shows that SAeUron only achieves the best score in In-domain Retain Accuracy (IRA) and average performance of style unlearning. This does not fully support the claim that SAeUron achieves state-of-the-art results in object and style unlearning.\n\nThe authors claim that SAeUron is robust to adversarial attacks, arguing that other methods provide only a limited understanding of base model changes and fail to fully remove targeted concepts. However, Table 1 indicates that SalUn achieves better object unlearning and FID scores than SAeUron, raising questions about its comparative effectiveness. Additionally, the paper lacks qualitative comparisons with baselines to demonstrate that SAeUron selectively removes only the targeted concepts, unlike base models.\n\nWhile Figure 8 suggests strong resistance to adversarial attacks such as UnlearnDiffAtk, Figure 18 does not show similar robustness for object unlearning attacks. The authors attribute this discrepancy to the evaluation method used for object unlearning but do not clarify whether object unlearning results were excluded in Figure 8, leading to uncertainty about the experimental setup. Furthermore, Table 5 in the appendix presents CLIPScore results before and after a successful adversarial attack but lacks baseline comparisons, making it difficult to determine whether SAeUron outperforms other methods, especially in adversarial attacks.", "methods_and_evaluation_criteria": "The proposed method is primarily evaluated on object and style unlearning. However, unlearning is particularly crucial for NSFW content, which aligns more with concept unlearning rather than just object or style removal. It is also essential for protecting portrait rights. Since the authors do not assess their method on NSFW content, sensitive concepts, or portrait rights, it remains unclear how effectively SAeUron addresses real-world unlearning challenges. This gap in evaluation limits the method's applicability to practical scenarios where unlearning is most critical.", "theoretical_claims": "There are no theoretical claims.", "experimental_designs_or_analyses": "1. **Choice of Blocks**: The decision of where to apply the Sparse Autoencoder (SAE) is critical. The authors mention that they empirically modified the cross-attention layers in the Up block, but the rationale behind prioritizing this block over others remains unclear. While the reviewer acknowledges that the choice of cross-attention blocks is based on prior work (Basu et al., 2024), the authors also highlight distinct attribute-specific differences in causal state distribution (e.g., style being more relevant in self-attention blocks). Additionally, previous research [A] suggests that self-attention layers in the Up block are particularly effective for preserving style. This raises an important question: Would modifying different blocks (e.g., Up, Mid, Down) or targeting self-attention layers instead of cross-attention layers result in better performance? Performing an ablation study on this aspect, beyond just qualitative ablation results, would further strengthen the argument.\n2. **Lack of Qualitative Examples**: Since this is a generation-focused paper, it is essential to provide substantial qualitative examples covering a wide range of results. However, the number of provided visual examples is limited, and there are no qualitative comparisons with other baselines. Without such comparisons, it is difficult to assess how SAeUron performs relative to existing methods in terms of preserving image quality while achieving unlearning.\n3. **Choice of Thresholds**: While SAeUron enables controlled feature modification through percentile-based selection, there is no ablation study examining its effectiveness in determining the optimal level of change. Specifically, ablations on different threshold values are missing, and the selection is stated to be empirical rather than systematically justified. Without such an analysis, it remains unclear how well SAeUron balances concept removal and image preservation, making its robustness to adversarial attacks less substantiated.\n\n**References**\n[A] Jaeseok Jeong, Junho Kim, Yunjey Choi, Gayoung Lee, Youngjung Uh, Visual Style Prompting with Swapping Self-Attention, arxiv 2024", "relation_to_broader_scientific_literature": "The proposed method builds on key existing research, particularly Sparse Autoencoders and Diffusion Models. A key contribution is demonstrating that unlearning in diffusion models can be achieved using an Autoencoder without requiring full fine-tuning of the entire model. This approach is both simple and intuitive, making it explainable compared to traditional fine-tuning methods. This level of interpretability makes it particularly valuable for controlling.", "essential_references_not_discussed": "The paper tackles the robustness from the adversarial attacks, yet they did not include the baselines rather recent and specifically robust to those methods [B,C,D]\n\n[B] Shilin Lu, Zilan Wang, Leyang Li, Yanzhu Liu, and Adams Wai-Kin Kong. Mace: Mass concept erasure in diffusion models. CVPR, 2024.\n\n[C] Chi-Pin Huang, Kai-Po Chang, Chung-Ting Tsai, Yung-Hsuan Lai, and Yu-Chiang Frank Wang. 2023. Receler: Reliable concept erasing of text-to-image diffusion models via lightweight erasers. ECCV 2024.\n\n[D] Chao Gong, Kai Chen, Zhipeng Wei, Jingjing Chen, Yu-Gang Jiang. Reliable and Efficient Concept Erasure of Text-to-Image Diffusion Models, ECCV 2024", "other_strengths_and_weaknesses": "Compared to other existing unlearning approaches, this paper addresses the unlearning problem using an autoencoder that operates independently of diffusion models, which is a notable strength.\n\nMy major concern is the lack of exploration of experimental settings and insufficient experimental results.  Please see Claims And Evidence* and Experimental Designs Or Analyses*.\n\nThe authors did not specifically mention which Stable Diffusion model version was used in this paper.", "other_comments_or_suggestions": "no", "questions_for_authors": "**Practical Applications**: The paper primarily focuses on object and style unlearning, but practical applications of unlearning extend to sensitive content removal, such as NSFW content or specific individuals in generated images. Given the increasing importance of content moderation in generative models, an evaluation on concept unlearning for NSFW or identity removal would better demonstrate the real-world applicability of SAeUron. Have the authors considered these use cases, and how well does the method perform in such scenarios?\n\n\n**Efficiency**: The authors think it is an efficient method? Methods like SLD or Receler do not require additional training or require only lightweight training, whereas SAeUron involves learning whole autoencoder networks, which may introduce overhead. Additionally, since the threshold selection is empirical for specific object (Table 4), how does this impact efficiency?\n\n\n**Generalization to Out-of-Distribution (OOD) Data**: Table 3 suggests that SAeUron generalizes well to OOD settings, but the underlying reason for this generalization is not well explained. What specific properties of SAeUron contribute to its robustness in OOD scenarios? Furthermore, how do other benchmark methods perform under the same experimental setup?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Lt2XzO2gXJ", "reviewer": "Reviewer_8Z9i", "summary": "This paper presents an efficient unlearning framework that leverages sparse auto-encoders to identify relevant features that represent the concepts users want to negate. In previous studies, it was challenging to effectively erase specific concepts while preserving the ability to generate images. This is because unlearning specific concepts leads to modifications in network parameters, resulting in influences on creating images unrelated to that concept. Technically, this paper employs a two-phase approach. In the first phase, the sparse auto-encoder is trained using benchmark datasets developed by [1]. In the second phase, the trained sparse auto-encoder is used to discriminate effective features for unlearning. Empirically, this paper demonstrates that the proposed method achieves comparable results in both concept erasure and maintaining image quality, even with significantly reduced computational resources compared to previous approaches. \n\n[1] Kumari, Nupur, et al. \"Ablating concepts in text-to-image diffusion models.\" CVPR2023.\n\n## **Update after rebuttal**\n\nI appreciate the author’s effort in addressing my remaining concerns. After reviewing their response, which discusses limitations and provides additional experimental results for erasing similar concepts, I am satisfied with the response and the logical approach. Therefore, I decide to increase my score by \"Accept\".", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Link to additional tables and figures: [Anonymous github](https://anonymous.4open.science/r/saeuron-8D02/saeuron_rebuttal.pdf)\n> **Nudity evaluation**\n\nWe thank the Reviewer for suggesting showcasing SAeUron's strength in the real-world use case of unlearning nudity. To do this, we evaluated our method on an established I2P benchmark consisting of 4703 inappropriate prompts.\nWe train SAE on SD-v1.4 activations gathered from random 30K captions from COCO train 2014. Additionally, we add to the train set prompts \"naked man\" and \"naked woman\" to enable SAE to learn nudity-relevant features. SAE is trained on up.1.1 block, following all hyperparameters used for class unlearning in our submission. We use our score-based method to select features related to nudity, selecting features that strongly activate for \"naked woman\" or \"naked man\" prompts and not activating on a subset of COCO train captions.\n\nFollowing other works, we employ the NudeNet detector for nudity detection, filtering out outputs with confidence less than 0.6. Additionally, we calculate FID and CLIPScore on 30k prompts from the COCO validation set to measure the model's overall quality when applying SAE. As shown in Tab 2, SAeUron achieves state-of-the-art performance in removing nudity while preserving the model's overall quality. This highlights the potential of our method in real-world applications.\n\n> Relation to [1]\n\nThank you for pointing out this interesting paper. We respectfully note that **it has been submitted to arxiv after the conference deadline**. Nonetheless, while both works intervene on SAE's latent space to remove undesirable concepts, there is a crucial difference in that [1] trains SAE on activations of the text encoder while we directly apply our approach to the diffusion UNet. Since both works utilize SAEs for similar use cases, we will gladly add this paper as concurrent work in the final version of our submission.\n\n[1] Kim, Dahye, and Deepti Ghadiyaram. \"Concept Steerers: Leveraging K-Sparse Autoencoders for Controllable Generations.\"arxiv2025.\n\n> I believe that the two-phase approach is challenging in terms of training time for unlearning.\n\nTo showcase the efficiency of our approach, we measure the time needed to present the results of unlearning in Figs 11 and 12. We evaluate the scaling of the SAeUron approach using the training set of sizes: 100, 200, 500, 750, and 1000 images. We train our SAE for 5 epochs for each scenario, keeping the hyperparameters constant. Our approach achieves good unlearning results even in limited training data scenarios while being more efficient from all methods requiring fine-tuning. \n\n> Online (streamlined) unlearning is appealing but lacks a rigorous explanation for the preservation metrics. \n\nIn our main experiments, we stricktly follow the evaluation provided by the UnlearnCanvas benchmark where independently trained classifiers are provided to evaluate *In-domain retain accuracy (IRA)* that measures the quality of generation of other concepts when unlearning a particular one (e.g., 49 other styles when unlearning a single one), and *cross-domain retain accuracy (CRA)* which assesses the preservation quality in a different domain (e.g., in style unlearning, we calculate object classification accuracy). Additionaly, following instructions from the benchmark, we report the FID metric when generating all of the concepts except for the unlearned ones.\n\n> I believe that this paper needs to explore the correlation among multiple concepts and how stable performance is maintained.\n\nWe agree with the Reviewer that capturing concept-specific features doesn't directly imply precise unlearning. To measure the impact of unlearning on other concepts in Fig 9 we present accuracy on each of 20 classes from UnlearnCanvas benchmark during unlearning. For most classes, our method successfully removes the targeted class while preserving the accuracy of the remaining ones. Nonetheless, in some cases where classes are highly similar to each other (e.g., Dogs and Cats), removing one of them negatively impacts the quality of the other. This observation is consistent across evaluated methods as presented in appendix D.3 of the original [UnlearningCanvas benchmark](https://arxiv.org/abs/2402.11846).\n\nTo study how well the stable performance of our method can be maintained, we run an additional experiment where we subsequently unlearn 49 out of 50 styles present in the UnlearnCanvas benchmark (leaving one style out to evaluate the quality of its preservation). We observe almost no degradation in SAeUron performance for three randomly selected combinations. **For unlearning of 49/50 styles simultaneously, we observe UA: 99.29%, IRA: 96.67%, and CRA: 95.00%**. Those results highlight the unprecedented degree of unlearning precision with SAeUron.\n\nWe hope our responses have clarified your questions and addressed any concerns. If so, we would appreciate your consideration in raising the score.", "claims_and_evidence": "This paper aims to address the issue of reduced image quality after unlearning specific concepts. While the experimental results show that the numeric values for concept erasure are moderate across all benchmarks, the paper achieves comparable generation quality at the lowest costs, as measured by FID scores. Namely, this paper contributes to the development of the most cost-effective concept erasure method while maintaining image quality.", "methods_and_evaluation_criteria": "Its experimental design makes sense for concept erasure.", "theoretical_claims": "No discuss", "experimental_designs_or_analyses": "I believe that nudity would be an effective way to showcase its strength.", "relation_to_broader_scientific_literature": "The paper’s key contribution lies in its focus on computation budget, as evident from previous research. This paper presents experimental results that demonstrate the achievement of comparable performance in an efficient manner. The paper’s advantage lies in the use of a sparse auto-encoder to identify effective features releated to specific concepts. \n\n[1] Gandikota, Rohit, et al. \"Erasing concepts from diffusion models.\" CVPR2023.   \n[2] Gandikota, Rohit, et al. \"Unified concept editing in diffusion models.\" WACV2024.", "essential_references_not_discussed": "The key contribution of this article lies in its effective and efficient concept erasure technique, which leverages a sparse autoencoder. As a concurrent work, this paper also aims to eliminate unsafe concepts [1]. While it’s understandable that the authors may not need to directly compare their approach with [1], it would be beneficial for them to address different aspects of their methodology.\n\n[1] Kim, Dahye, and Deepti Ghadiyaram. \"Concept Steerers: Leveraging K-Sparse Autoencoders for Controllable Generations.\"arxiv2025.", "other_strengths_and_weaknesses": "### **Weakness** ### \n\n- I believe that the two-phase approach is challenging in terms of training time for unlearning. While its efficient algorithm uses minimal computational resources, it becomes impractical if it requires excessive time.\n- The authors have presented developing online (streamlined) unlearning approaches that can simultaneously eliminate multiple concepts [1]. I find this capability more appealing than single concept erasure. However, this paper lacks a rigorous explanation for its preservation metrics. Capturing exact features for a specific concept doesn’t necessarily mean direct erasure of that concept stably. Instead, I believe the relative magnitude of the concept compared to others should be considered when choosing an unlearning objective. Nevertheless, this paper emphasizes on numerical performance where the proposed method outperforms baselines in multi-concept erasure. \n\n[1] Lu, Shilin, et al. \"Mace: Mass concept erasure in diffusion models.\"CVPR2024.", "other_comments_or_suggestions": "I believe that the sequence of concepts depends on the difficulty of erasing them. Especially, there might be ambiguous situations where we want to negate “chiwhawha” but preserve “cats” after erasing “tiger.” In this case, I’m curious that sparse autoencoders still manage to raise “chiwhawha” but preserve “cats.” I believe that this paper needs to explore the correlation among multiple concepts and how stable performance is maintained.", "questions_for_authors": "The paper’s dense content makes it challenging to grasp its main technical message. \nI believe that the presentation of numerical superiority doesn’t necessarily imply its worthiness for acceptance at a top-tier conference. In particular, the title suggests that the paper should demonstrate the explainability of unlearning and its relevant features. However, I fail to understand why this paper stands out compared to baselines. While the high-level context appears reasonable, the current presentation lacks a technical explanation for its superiority over baselines. Essentially, this study demonstrates the power of sparse autoencoders and the effectiveness of a linear combination of unlearning.\n\nIn the rebuttal, I hope the authors present a comprehensive analysis of the explanability and effectiveness of its approach in ambiguous situations where multiple concepts intersect. If they do so, I will vote for acceptance. However, the current form does not convince to meet the standard of top-tier conferences.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {"ethical_review_concerns": "No"}}, {"review_id": "7FJxhdEU56", "reviewer": "Reviewer_vmrV", "summary": "This paper introduces SAeUron, a concept unlearning method for text-to-image diffusion models that leverages sparse autoencoder (SAE). The authors first train an SAE on features extracted from the cross‐attention layers and then perform unlearning based on the feature importance scores of specific concepts. During inference, the selected features are modified by applying a negative multiplier while preserving the activations of other concepts. Experimental results demonstrate that the proposed approach outperforms other baselines on style unlearning and maintains robustness after sequential concept removal and under adversarial attacks.\n\n## update after rebuttal\nSince most of my questions have been addressed, I have raised my score to 4", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for the positive review of our work, we would like to explain and address the comments and remaining weaknesses with the help of additional tables and figures provided in the anonymized link [Anonymous github](https://anonymous.4open.science/r/saeuron-8D02/saeuron_rebuttal.pdf):\n\n>The paper lacks a comprehensive ablation study on the intervention mechanism. Specifically, it is uncertain if the chosen negative multiplier is the optimal way to modify the SAE features or if alternative interventions, such as zeroing out the feature or dynamically set multiplier might yield better results.\n\nThank you for pointing out this omission. Our unlearning method has two main parameters: the number of features selected for unlearning (percentile) and the negative multiplier. We comprehensively analyze their impact in the additional results. As shown in Figure 10, our method is robust to these parameters, with a broad range of values—apart from extreme cases—yielding comparably high performance. Following the reviewer's suggestion, we evaluate the alternative intervention of zeroing out features (when multiplier = 0), observing that we need negative values of the multiplier in order to obtain satisfying unlearning results.\n\n>It remains unclear whether the removal of one concept (e.g., Husky) may inadvertently affect the generation of similar or neighboring concepts (e.g., Chihuahua). A deeper analysis of collateral damage on related concepts after unlearning would strengthen the study.\n\nTo provide a more comprehensive analysis of the unlearning effect on similar concepts, in Fig.9, we present how the unlearning of a specific object affects all of the other objects evaluated in the UnlearnCanvas benchmark. We can observe some cases where the unlearning of, for example, *dogs* can lead to the degradation of the quality of *cats*. This observation is consistent across evaluated methods as presented in appendix D.3 of the original [UnlearningCanvas benchmark](https://arxiv.org/abs/2402.11846).\n\n>For practical deployment, it would be valuable to evaluate the method’s performance when a large number of concepts (e.g., all 50 concepts in the UnlearnCanvas benchmark) are removed simultaneously. It is unclear whether the method can retain its performance under such extreme scenarios.\n\nThank you for this excellent suggestion. We run additional experiments to evaluate such an extreme approach, where we simultaneously unlearn 49 out of 50 styles present in the UnlearnCanvas benchmark (leaving one style out to evaluate the quality of its preservation). For 3 randomly selected combinations, we observe almost no degradation in SAeUron performance. **For unlearning of 49/50 styles simultaneously, we observe UA: 99.29%, IRA: 96.67%, and CRA: 95.00%**. Those results highlight the unprecedented degree of unlearning precision with SAeUron.\n\n>The reported 10% computational overhead during inference is relatively high compared with alternative approaches such as ESD or SalUn. This increased overhead may limit the practicality of the method in time-sensitive applications.\n\nThank you for highlighting this important limitation of our approach. Your feedback prompted us to re-evaluate our implementation. Since the SAE is a small linear model, its forward pass adds only two matrix multiplications, which should be negligible compared to the diffusion UNet model. Upon further analysis, we discovered that the 10% computational overhead was primarily due to an inefficient implementation: we were redundantly recalculating the same feature selection for unlearning during each pass through the UNet model. By computing this information once and storing it in memory, we have now reduced the computational overhead to just 1.92%.\n\nThank you for noticing that our method is one of the few studies that have applied SAE to achieve state-of-the-art results in practical applications. To further strengthen this claim, in Tab.2 of additional results, we present how SAeUron can also be used in an even more practical use-case of nudity unlearning, where it also achieves state-of-the-art results. \n\nWe hope that our answers provided meaningful clarification to your questions and addressed all of the weaknesses. If true, we kindly ask the reviewer to consider raising their score.", "claims_and_evidence": "The claims are convincing. The authors provide clear evidence showing that the selected concept features are interpretable and that the method achieves state-of-the-art performance compared with existing baselines.", "methods_and_evaluation_criteria": "The proposed method is well motivated and appears well-suited to the problem of machine unlearning in text-to-image diffusion models. In particular, the use of sparse autoencoders enables the removal of specific concept features while largely preserving other generative capabilities. The evaluation, which employs an existing benchmark for this task, shows promising results that support the effectiveness of the approach.", "theoretical_claims": "N/A", "experimental_designs_or_analyses": "**Strength:**\n\nThe experimental design is grounded in established benchmarks. The analysis of feature interpretability convincingly demonstrates that the method is able to extract meaningful, concept-specific features from the diffusion model.\n\n**Weakness:**\n\n- It remains unclear whether the removal of one concept (e.g., Husky) may inadvertently affect the generation of similar or neighboring concepts (e.g., Chihuahua). A deeper analysis of collateral damage on related concepts after unlearning would strengthen the study.  \n- The paper lacks a comprehensive ablation study on the intervention mechanism. Specifically, it is uncertain if the chosen negative multiplier is the optimal way to modify the SAE features or if alternative interventions, such as zeroing out the feature or dynamically set multiplier might yield better results. \n-  For practical deployment, it would be valuable to evaluate the method’s performance when a large number of concepts (e.g., all 50 concepts in the UnlearnCanvas benchmark) are removed simultaneously. It is unclear whether the method can retain its performance under such extreme scenarios.", "relation_to_broader_scientific_literature": "Although there is extensive literature on mechanistic interpretability using sparse autoencoders, few studies have applied this technique to achieve state-of-the-art results in practical applications. The success of SAeUron in attaining competitive performance is therefore surprising and provides valuable insights into how sparse autoencoders can be utilized in real-world scenarios.", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "The reported 10% computational overhead during inference is relatively high compared with alternative approaches such as ESD or SalUn. This increased overhead may limit the practicality of the method in time-sensitive applications.", "other_comments_or_suggestions": "N/A", "questions_for_authors": "See Experimental Designs Or Analyses", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: The concerns raised by the reviewers were addressed in the rebuttal. Three out of the four reviewers have updated their recommendations to accept the paper. The remaining issues raised by the one reviewer who  recommended weak rejection have been checked by the AC. The AC thinks the responsed would have convinced the reviewer. As a result, the AC assumes that this reviewer will increase their score. In summary, this paper would have received a positive rating, and the AC sees no reason to overturn the consensus of the reviewers. Therefore, the AC recommends accepting the paper.
Decision: Accept (poster)