Unveiling Concept Attribution in Diffusion Models
Authors: Quang H Nguyen
Hoang Phan
Khoa D Doan
Venue: NeurIPS 2025 poster ()
Keywords: generative models
diffusion models
interpretability
concept erasure
Primary area: social_and_economic_aspects_of_machine_learning
TL;DR: We study how model components store knowledge in diffusion models.

Abstract: Diffusion models have shown remarkable abilities in generating realistic and high-quality images from text prompts. However, a trained model remains largely black-box; little do we know about the roles of its components in exhibiting a concept such as objects or styles. Recent works employ causal tracing to localize knowledge-storing layers in generative models without showing how other layers contribute to the target concept. In this work, we approach diffusion models' interpretability problem from a more general perspective and pose a question: \textit{``How do model components work jointly to demonstrate knowledge?''}. To answer this question, we decompose diffusion models using component attribution, systematically unveiling the importance of each component (specifically the model parameter) in generating a concept. The proposed framework, called \textbf{C}omponent \textbf{A}ttribution for \textbf{D}iffusion Model (CAD), discovers the localization of concept-inducing (positive) components, while interestingly uncovers another type of components that contribute negatively to generating a concept, which is missing in the previous knowledge localization work. Based on this holistic understanding of diffusion models, we present and empirically evaluate one utility of component attribution in controlling the generation process. Specifically, we introduce two fast, inference-time model editing algorithms, CAD-Erase and CAD-Amplify; in particular, CAD-Erase enables erasure and CAD-Amplify allows amplification of a generated concept by ablating the positive and negative components, respectively, while retaining knowledge of other concepts. Extensive experimental results validate the significance of both positive and negative components pinpointed by our framework, demonstrating the potential of providing a complete view of interpreting generative models.

Unveiling Concept Attribution in Diffusion Models
Quang H. Nguyen', Hoang Phan 1.2, Khoa D. Doan College Engineering and Computer Science, VinUniversity "VinUni-llinon Smart Health Center, VinUniversity {quang.ni nh, 21hoang P, khoa. dvinnni edu. vn
Abstract
Diffusion models have shown remarkable abilities in generating realistic and high- quality images from text prompts. However, a trained model remains largely black-box; little do know about the roles of its components in exhibiting concept such as objects or styles. Recent works employ causal tracing to localize knowledge-storing layers in generative models without showing how other layers contribute to the target concept. In this work, we approach diffusion models' inter- pretability problem from more general perspective and pose a question: "How do model components work jointly to demonstrate knowledge?". To answer this ques- tion, decompose diffusion models using component attribution, systematically unveiling the importance of each component (specifically the model parameter) generating concept. The proposed framework, called Component Attribution for Diffusion Model (CAD), discovers the localization of concept-inducet tive) components, while interestingly uncovers another type of components that contribute negatively to generating a concept, which is missing in the previous knowledge localization work. Based on this holistic understanding of diffusion models, we present and empirically evaluate one utility of component attribu- tion controlling the generation process. Specifically, we introduce two fast, inference-time model editing algorithms, CAD-Erase and CAD-Amplify; in par- ticular, CAD-Erase enables erasure and CAD-Amplify allows amplification of generated concept by ablating the positive and negative components, respec- tively, while retaining knowledge of other concepts. Extensive experimental results validate the significance of both positive and negative components pinpointed by our framework, demonstrating the potential of providing a complete view interpreting generative models. Our code is available here
(posi-
Introduction
Recent developments in diffusion models [8, 26, 36 37 have greatly improved the synthesizing capabilities, in terms of image quality and the diversity of generated knowledge. However, these models lack interpretability; we do not fully understand how they can translate simple prompts to coherent visual outputs. To investigate how generative models express learned concepts, recent line of work studies which components in the model store knowledge 2 27]. In language models, Meng al. (27] propose causal tracing to locate layers storing facts and reveal that knowledge is localized in middle-layer MLP modules. Basu et al. [2] transfer this approach to diffusion models and propose the knowledge distributed hypothesis. They show that, unlike language models, knowledge is distributed among a set of UNet components and the first self-attention layer of the text encoder. These works shed light on interpreting generative models, enabling more effective model editing [3] 2) Nevertheless, they focus only on knowledge storage storage-modules that are responsible for generating concepts-and on coarse-grained grained components, such layers. This perspective may overlook more subtle properties and other types of modules that also influence the outputs.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Diffusion model
To address that limitation, this paper first poses a more general question: How do components in diffusion models contribute to generated concept? We introduce framework that pre- dicts the model's behavior given the presence of each component by identifying its contribu- tion through efficient linear counterfactual estimator (35]. Through this framework, called Component Attribution for Diffusion Model (CAD), we advance the understanding of how model components activate concepts (e.g., ob- jects, styles, or explicit contents) in diffusion models. In contrast to the prior work that fo- cuses on the model's 's layers, CAD allows anal- ysis of more fine-grained components. Specifi- cally, we revisit the distributed hypothesis [2] and leverage CAD to identify concept-inducing (or positive) components that are similar to knowledge storage. However, by focusing on the most fine- grained components, i.e., the model's parameters, we propose the localization hypothesis: knowledge localized in a small number of parameters. Surprisingly, besides the positive components, CAD also reveals the existence of components that contribute negatively to generating the target concept, which missing in the previous studies. Ablating positive or negative components decreases or increases the probability of generating the corresponding knowledge. As one example of its utility, this holistic understanding of diffusion models enables lightweight model editing capability, i.e., to remove (positive) or recall (negative) a concept. Figure [ illlstrates the proposed CAD framework. In summary, our contributions are:
Prompt e "A proto
Gesercted imaye
comporeth
eugaeise couepencts
other companamee
Figure I: Overview of our framework. We show that there exist positive and negative components in diffusion that increase or decrease the probability of the target concept, respectively. Removing those components will have the reverse effect.
We propose CAD, a comprehensive framework, that can compute the attribution scores of the diffusion model components based on efficient and effective linear counterfactual predictor.
Utilizing CAD, we confirm the existence the concept-inducing (positive) model's param- eters, while revealing their localized nature. CAD is also the first work that uncovers the existence of another type of components - the concept-amplificatio (negative) components.
Leveraging these observations of localized positive and negative components, we develop two lightweight knowledge editing algorithms for diffusion models, CAD-Frase for concept erasing and CAD-Amplify for concept amplification, respectively.
We analyze CAD and evaluate the effectiveness of the proposed editing algorithms with extensive experiments, demonstrating their practicality and effectiveness.
2 Related Works
Interpreting Neural Networks. Several research has extensively studied the black-box mechanism
of neural networks to explain their behaviors. line of works 34 42 visualize important input regions of classification models by using the gradient of feature map activations. Sundararajan et al. [38 formalize the problem of attributing the input and propose two axioms to design attribution methods. Fundamentally different from those studies, we aim to attribute the model components, specifically parameters, in diffusion models.
Knowledge Localization. Previous work explored how language model components store factual knowledge [6 g or used model attribution to analyze the impact of individual components in the image classification and language prediction task 35). However, due to the iterative generative process and the difference in knowledge storing, applying these approaches diffusion models is challenging. Another line of research [ 27
39 7 49 utilizes causal analysis to identify critical layers for knowledge in language models and T2I Latent Diffusion variants. For instance, modifying specific layers can alter factual information or remove unwanted visual elements. While these methods have shown successes in localizing knowledge, Hase et al. [17 discover that editing non-causal layers can also modify stored facts in language models. This finding implies that causal analysis may answer a different question from model editing. Furthermore, these approaches inspect the activations, which are dependent on the input, whereas our work studies the parameters of the

---

model. Dravid et al. [9] examine the weight space of several customized diffusion models; in contrast, our work offers an efficient approach to studying individual model component roles.
Concept Erasure. Latent diffusion models (LDMs) can generate undesirable content (e.g., nudity, outdated information, copyrighted artistic styles) due their large and uncontrolled training datasets.
50 |2 or remove multiple concepts simultancously in real-world scenarios. More recent works aim to improve
Early efforts address this problem involved fine-tuning Cross-Attention layers [1 20 21
editing the text-encoder [ 2] In addition, several research 12
25
4
highlight the necessity
robustness of erasing methods red-teaming attacks, including ConceptPrune [5]. RECE [T3.
RACE [19], and pruning methods [45]. These methods enable efficient erasure of various contents while ensuring minimal interference with the unedited ones.
inserts new objects into the model by identifying concept neurons. In contrast, CAD-Amplify locates components magnify existing knowledge in diffusion models. Dai et al. [8] also proposes a method to amplify facts, but relies on amplifying positive neurons. Our work is the first study showing the existence of negative components and how to systematically locate them.
Concept Amplification. Motivated by Dreambooth [33, Cones 24
Red- Red-Teaming Attacks. Although line-tuning climinates undesirable concepts in text-to-image models, recent studies 647 51 46) 48) [4] (30] show that this approach remains unreliable against adversarial prompt attacks. These safety mechanisms can be bypassed by both black-box (e.g., SneakyPrompl [47, Ring-A-bell (41) and white-box attacks (e.g.. P4D [6], Unlearniiff (51),, leading to the regeneration of sensitive content. These attacks highlight the need for robust defenses that fully remove concepts while preserving image quality. More importantly, we can also employ these attacks to test if concept has been truly erased from model.
Pruning Approaches. Similar to our algorithms,, many studies [14 10 have investigated pruning neural networks, primarily for time and memory efficiency. Specifically, (28
22 40 use gradient
information to identify and remove less important parameters, thereby improving inference speed. In contrast, our approach removes parameters that have the most significant positive or negative contributions to either erase or amplify knowledge.
3 Preliminaries
26 36, 37] generative models that perform denoising process, starting from random Gaussian noise, over several time steps T. Particularly, the forward Markov process first transforms real image zo into noisy image I, yazzo vI a,e at time step I, where ae a decaying parameter and 6 ~ (0, 7). Then in the reverse process, a denoiser is trained predict the noise 6 each time step 1, thereby generating noisy image .t, After series of discrete time steps, the diffusion model generates the final reconstructed image To-
Diffusion Models. Diffusion models [18
Latent Diffusion Models. LDMs 32 help accelerate the denoising process by employing a pre- trained variational autoencoder with an encoder & and a decoder and performing the denoising process in the latent space. At each time step 1, LDMs predict the noise (b(-lc), conditioned by a text prompt c and parameterized by 8. The objective function is = (2,, c, t) where e is Gaussian noise, and (2 C, t) is the estimated noise added to latent 2n at time step by LDMs.
4 Concept Attribution in Diffusion Models
In this section, we provide the general formulation of concept attribution in diffusion models, discuss the challenge of solving this problem, and propose CAD framework.
4.1 Decomposing Knowledge in Diffusion
We consider the diffusion model as a combination of building blocks w;. Let [(c, w) be any function that returns real number representing how well the model f. with a set of components w, generates the concept c. We can inspect the model at different levels of granularity; for example, a component can be a parameter, a layer, module. Our paper, however, focuses on the model parameters, which are the most tineggraieed components; nevertheless, our work can generally be extended to other types of components (i.e., layers or modules).
3

---

Our goal is to interpret how each component contributes to generating a concept, quantified by J[c, w). Similar to prior research causal mediation analysis [27 43 our study also focuses on "intervening" by "knocking out" to measure the counterfactual effect: i.e., we examine if model parameters induce a certain ability by removing them from the model. Specifically, we estimate how [c, w) changes if we set the value of a component w; to O. Let d be the new set of components obtained by adjusting some components to O, we want to find function g0w;; c) = [(, w) where Oz {0, 13a, d is the number of components, and
0 úū 0
m ) 1 ú;; W
Diffusion models are constructed from deep neural networks with non-linear activation between layers, and iterative processes to generate images. Consequently, the function g might be complex and difficult to learn. Interestingly. Shah et al. [35] show that a simple linear function can well approximate g in image classification models and language models. Here, we similarly approximate g with a linear model:
[c, t)) - g00;;c) ss a Or + be, ae E E...
(2)
Each coefficient Og.. represents how the component w; contributes to the concept Another way to intervene is to amplify the effect of w; by rescaling its magnitude; however, unlike knockout, which removes the component completely, scaling may preserve interactions, and deciding the magnitude of the change can be non-trivial. Nevertheless, we investigate this type of intervention in the Appendix.
4.2 CAD: Component Attribution for Diffusion Model
The challenge of learning ax. One way to find a. is by treating Equation (2) as a machine learning model [35. We can create a size-N dataset D: {(0,,. J[, )) : on E {0,1)") Ji=1 by randomly masking out some components of the diffusion model (i.e., to create the input w()) Then, train linear regression model and obtain a, the coefficient in the model. Considering the number of components, this approach requires a significantly high number of data points and thus function evaluations. For instance, Shah et al. (35] created 100, 000 data points for image classification and 200, 000 for language modeling to examine a single prediction. Furthermore, since diffusion models require iterative process generate data, generating such data points is significantly more time-consuming. Therefore, this approach of generating data to learn a for concept is prohibitively expensive or inefficient.
Our approximation method.
Instead, we propose to approach Equation 22 from a different perspective. Assuming our focus is a small subset of components w,, S and want to examine how J[c, w) changes if w: = O, we can apply first-order Taylor expansion as follows
OJ(c,w) w)
Σ aa. = He, w) J (c. () (w क) V a (c, iES
Σ
w
Ow:
$ES
From Equations 2 and B we see that the coefficient Ocei of wy can approximated by w; Duc. For the rest of the study, we will use this formulation to attribute a component in the model. In particular, our method measures the contribution of a component w; to the objective J, or the attribution score, by u: aJ(c..)) which only requires single forward and backward pass instead of Øw: creating the training data for the model in with many forward passes.
aJ(c.u))
5 Editing Diffusion Models with CAD
In this section, we discuss the importance of studying parameter attributions in concept generation via two applications of CAD. Specifically,, propose and empirically evaluate two lightweight, inference-time editing algorithms that remove (CAD-Erase) or amplify (CAD-Amplify) a concept in diffusion models.
As J[c, w) describes how well the model generates a concept e, observing its changes allows us to edit diffusion models. Given the attribution scores of model components computed using the proposed approach in Section 4.2 4.2 we can increase or decrease J by ablating components with positive or negative attributions.

---

5.1 Localizing and Erasing Knowledge
apply causal tracing to study which layers in generative models store knowledge. While this approach gives some insights into the model, it does not allow fine- grained understanding of parametric knowledge, Le., more fine-grate tineigraiedd components in the causal layers may play different roles. In contrast, CAD allows us focus the most fine-gra grreggra components, i.e., the model parameters, and ex- amine the influence of each parameter gen- erating a concept. Formally, we define positive components for concept those that when being ablated, the model has a lower probability of generating c.
Previous works [27 3
Algorithm 1: CAD-Erase
Input: Diffusion model D target concept c, base condition cb the number of components i..
Output: Diffusion model &' with a lower chance to generate concept c.
Generate a set of x conditioned on c. Compute the scores w; Bw.
aJ with Eq. (4)
Locate top-k components wi E S with the (positive) attribution.
Set w/ W/ S.
Concept Erasure. We consider these positive components knowledge storage, and finding them allows us to locate knowledge in generative models. We hypothesize that knowledge is localized: there exists small subset of components that makes the model not generate the concept when being ablated. This hypothesis also leads to a more accurate approximation discussed in Section 4.2 its finst-order expansion.
due to
Hypothesis 1. Knowledge is localized in small number of components. If we remove those components representing a concept c, the model will not generate e and other concepts are unaffected.
Concept Attribution Objective. Another question is which objective function J should be used. A naive choice is to directly use the training loss. However, previous work in concept erasing [21] shows that optimizing this objective to ablate concepts leads sub-optimal performance. Instead, rely on the following objective function (also used in (2))::
Jea (c, w) = E. ( cb. ts sg( - (( c, w)l
where is the target concept, c.g. the object "parachute", c is the base condition, e.g. the empty string sgg( force the predicted noise conditioned on the target concept to be close to the unconditioned noise, thus preventing the re- verse process from approaching the conditional distribution of the concept.
Algorithm 2: CAD-Amplify
sg() () is the gradient stopping op-
Input: Diffusion model Φ,, target concept the n.o. components k, images x of concept c. Output: Diffusion model &' with higher chance to generate concept c. a. Compute the scores w; Tw: with Eq. (5).
erator. Intuitively,
Locate top-k components w; E S with the lowest (negative) attribution.
CAD-Erase. We propose Algorithm T which erases concept from generative models, to val- idate Hypothesis [[ In general, we compute the attribution value of components by Equation and remove the top-k positive components. Note that, although there could exist a more effective algorithm than masking the top-k positive or negative components erase amplify (which focuses on proposing a general approach and its analysis on answer the question of "How do compo- nents in diffusion models contribute to the generated image?". . For example, one finetune these positive or negative components to achieve even better concept erasure or amplification, respectively; however, this is beyond the scope of our study and we leave it for future works.
Set w, + 0, w. E
will introduce next) concepts, respectively, our paper
5.2 Amplifying Knowledge in Diffusion Models
Our attribution framework offers a complete view of interpreting the model: besides positive com- ponents that are responsible for generating a concept, there also exist components with negative coefficients. We hypothesize that these components suppress knowledge, i.e., decreasing the proba- bility of inducing a concept. we ablate these negative components, the model will become more likely to generate an image with the concept.
Hypothesis 2. Negative components exist, and ablating them will amplify knowledge.
5

---

Previous works in knowledge localization (27 [ edit the model at modules storing knowledge. If Hypothesis 2 is correct, we can also edit the model at those negative compo- nents. For instance, user, perhaps with malicious intention, can remove negative components of a harmful concept to increase the chance that the diffusion model generates this concept.
Pearson correlation: 0.506
252
Objective function
250
248
246
244
CAD-Amplify. We propose Algorithm to amplify knowl- edge by ablating negative components. This approach as- sumes access to some images of the target concept and uses the training loss of diffusion models as the objective J:
242
-6
Attribution scores
Figure 2: The attribution scores pre- dicted by CAD and the actual values of the objective.
[c, w) Ceeeeeelll ||le- Eznne
(2 c, w)
(5)
6 Experiments
In this section, we aim to verify and provide a comprehensive empirical analysis of the knowledge localization hypothesis in Section 6.2 and the existence of negative components in Section 66.] We provide additional results on other diffusion models, different intervention, and ablating on different modules in the Appendix.
6.1 CAD Well Approximates the Change in the Objective
Table I: The accuracy of generated images on target classes and other classes, predicted by the pre-trained ResNet50 model.
Accuracy on target classes
Accuracy on other classes f
Classes
SD-1.4
ConceptPrune
ESD
RECE
UCE
CAD-Eruse
SD-14
ConceptPrune
ESD
RECE
UCE
CAD-Erase
Cassette player
7,20
2.60
0.00
0.00
0.00
0.40
86.07
76.73
57.53
89.13
89.13
80.13
Chain saw
69.00
1.00
0.40
0.00
0.00
0.00
79.20
63.97
24.24
75.69
75.69
69.22
Church
76.20
21.00
3.60
1.20
15.20
1.60
78.40
65.00
65.24
801.5
80.20
73.49
English Springer
93.80
1.00
0.20
0.00
0.10
1.40
76.44
62.00
47.48
77,80
78.00
71.91
French horn
60
7.40
0.20
0.00
4.40
75.91
45.11
74.33
74.33
70.87
Garbage truck
85.60
1.40
0.00
0.00
15.60
3.80
77.36
65.62
47.36
65.40
77.51
63.69
Gas pump
79.00
78.09
79.02
Gold ball
95.80
28.60
0.20
0.00
0.60
4.20
76.22
65.55
48.90
79.00
78.78
73.27
Parachute
96.20
30.00
0.80
0.00
1.00
2.00
76.18
62.17
61.28
78.20
77.87
68.91
Tench
80.40
2.80
1.40
0.00
0.00
0.20
77.93
67.57
60.80
78.56
78.56
72.67
In diffusion models, as mentioned in Section attributing the components is time-consuming and more complicated due their iterative generation process. Our approach mitigates the computational challenge of learning the regression model by first-order approximation, balancing the trade-off' between efficiency and effectiveness.
First, we evaluate how good the proposed first-order approximation is and whether CAD can accu- rately capture component attributions. We randomly ablate a small portion of parameters w,, S, in Stable Diffusion- ..4 and obtain the corresponding change in the objective. We also use CAD to compute the predicted change, indicated by Eies W/s Bw, evaluate CAD. Figure Figureeillusse illlustraees that our predicted values estimate well the actual changes in the objective with a good Pearson correlation. This analysis confirms the reliability of the proposed approximation, and consequently CAD, as a useful tool for analyzing the contribution of each component to concept.
aJ We repeat this process 1000 times and
6.2 CAD Can Locate Positive Components and Erase Knowledge
The analysis the previous section shows that CAD can successfully identify positive and negative components. We now utilize CAD to verify Hypothesis knowledge is localized in diffusion models. We conduct experiments on Stable Diffusion-1. 1.4 with different types of knowledge, particular, objects, nudity content, and art styles.

---

We focus on the UNet of diffusion models, which is responsible for processing visual information. For each linear layer, we remove no more than the top p% positive components each row.
5D
RDCE
Organi
Comcpthaue
LLB
(oae chagge le B
Essurco of selly ghorpp cor)
Toun oroter
Inarfcate wthoken (440 dwage betet
Clark
Figure The qualitative results of CAD. Remov- ing positive components to "English Springer" avoids generating that concept. Meanwhile, the model still retains knowledge of other classes such "Church" " and "Parachute".
Figure 4: The first two rows contain images gen- erated by the original model and crasing methods I2P prompts. We add for publication. The last two rows contain generated images condi- tioned other knowledge.
Erasing objects. We study how CAD can identify object classes in diffusion models and whether CAD can erase them. We select classes from ImageNette, "cassette player", "chain saw", "church", "English springer", "french horn", ", "garbage truck", "gas pump", "golf ball", "parachute" and "tench" For each class, we compute component attributions and ablate 0.1% components using Algorithm We generate 500 images per class and employ the pre-trained ResNet50 model to classify the generated images. We compare CAD with other state-of-the-art erasing methods, in particular ConceptPrune [5], ESD (.I) UCE [12. and RECE [33. Table T reports the accuracy the erased class and other classes of CAD and the other baselines.
Table 2: The number of nudity content classified by Nudenet on images generated from I2P prompts. We also provide CLIP-Score and FID computed on the COCO dataset to evaluate the quality of generated images normal prompts.
Model
Armpits
Belly
Buttocks
Feet
Breast (F)
Genitalia (F)
Breast (M)
Genitalia (M)
Anus Toral.
CLIP-Scoret
FID
SD-1.4
169
197
26
28
271
29
60
18
798
31.32
14.127
ConceptPrune
21
13
11
8
62
31.16
15.260
ESD
17
22
12
11
88
30.27
14.495
RECE
19
5
13
9
98
30.94
14.633
UCE
229
31.25
14.561
CAD-Erase
6
3
6
13
43
31.30
12.440
CAD- AAD-Amlliyy
229
242
34
360
33
18
991
First, we evaluate the capability of the base diffusion model generate images conditioned on text prompts. Table I shows that diffusion models can create high-fidelit, images that are correctly classified by ResNNet50, except for some hard classes such as "cassette player". However, by ablating small portion of parameters, CAD can successfully erase objects, illustrated by low accuracies for the target class. On the other hand, the accuracies for the other classes are still high, implying that removing positive components located by CAD do not have significant impact on other knowledge. We also provide qualitative results in Figure 3 demonstrating that CAD erases the target concept without affecting the other concepts. This observation verifies the knowledge localization hypothesis I
Table also implies that CAD-Erase, the model erasing algorithm based on CAD, can serve as competitive erasing method. Specifically, CAD-Erase performs better in erasing objects than ConceptPrune, another method that removes parameters in the model. ESD yields similar accuracies on the target classes to CAD- however, this method sacrifices knowledge of the other concepts, leading to low accuracies on the other classes. MAD-Erasee ' performance is on par with UCE and RECE, two state-of-the-a concept erasing methods that update the linear layer in cross-attention to map the target concept in the prompt to other concepts. In some cases, such as "church" and "garbage truck". UCE still fails to completely erase the concept while CAD-Erase reduces the accuracy on those classes to more than 3%.
7

---

Table 3:
The attack success rate of white-box attacks on the erased models. Lower is better.
Table 4: The number of nudity content and the drop from the original model classified by Nudenet on images generated from adversarial prompts. Lower is better.
Object
Model
Nudity
Church
Paruchute
Tench
Model
MMA
Ring-a-bell
P4D
UD
P4D
UD
P4D
UD
P4D
UD
SD-14
1941 (- (-00.00%)
414 (-00.00%
ConcepiPrruee
0.76
0.78
0.84
0.76
0.92
0.92
0.39
0.34
ConceptPrune
98 (-94.95%)
(-79.95%
ESD
0.69
0.76
0.56
0.60
0.48
0.54
0.28
0.36
ESD
279 (- 85.62%)
95 (-77.05%)
RECE
0.63
0.68
0.42
0.54
0.28
0.30
0.10
0.10
RECE
481 (- (-75.22%)
(-99.03%)
UCE
0.83
0.84
0.50
0.60
0.42
0.48
0.10
0.20
UCE
971 (-49.97%)
64 (-84,54%)
CAD-EErse
0.46
0.56
0.18
0.22
MAD-Erase
62 ( 96.81%)
5 (-98.7918)
Erasing nudity. Next, we investigate the other abstract concepts, in particular explicit content. We locate and ablate the top 0.075% positive components with the prompt "naked". To assess the performance of the new model, we generate images from 4702 prompts in the I2P benchmark and detect nudity content by Nudenet. We validate the performance on unrelated knowledge by generating images with 30, 000 prompts in the COCO dataset (23] Table Sablee[shok shows the results of CAD and the other baselines. As can be observed, CAD- Erase achieves the highest performance in erasing nudity content compared to other state-of-the-an methods, illustrated by the lowest number of nudity classes predicted by Nudenet. Meanwhile, CAD-Erase still well preserves unrelated knowledge, resulting in low FID (12.440) and a high CLIPScore (31.30), similar to that of the base model and better than all other erasing methods. Figure illustrates images generated by the original model and the ablated model from our method, As can be observed, CAD-Erase successfully erases explicit content and keeps other knowledge intact, while other methods fail to erase in some cases and also change the content on normal prompts. These results confirm knowledge localization of nudity content.
Erasing with adversarial prompts. Recent works
46 show that current erasing methods do not completely remove knowledge from the model, and propose attack methods that create adversarial prompts to induce the erased model to still generate harmful content. We evaluate our method on two unsafe prompt sets, MMA and Ring-A-Bell, in Table MMA successfully elicits explicit content from Con- ceptPrune, ESD, RECE, and UCE models, re- sulting in 98, 279, 481, and 971 predicted nu-
Orizza SD
Coeeopthsax
250
a002
UC2
Den
Ef OMuse aduo)
Interrence wit other LLo chasee
dity classes, respectively. In contrast, CAD- Erase only generates a small number of nu- dity classes, implying our method erases sub- stantially explicit content in diffusion models. On the other hand, ConceptPrune and UCE are prone to Ring-A A-Bell prompts, while RECE and CAD only generate around 5 predicted nudity classes. We also evaluate the model with white-box attacks such as P4D (6) and UnlearnDiff (UD) (15). Table 3 reports the attack success rate of white-box attacks in making the erased model generate the target concept. As we can observe, CAD-Erase is more robust than ConceptPrune, ESD, and UCE, and is on par with RECE, These results also further support the localization hypothesis, implying that knowledge is stored in a small number of components that are correctly identified by CAD.
Figure 5: Qualitative results of CAD on erasing artist styles. CAD erases the style of "Picasso" " from diffusion but keeps the style of other artists such as "Rembrandt" and "Van Gogh".
Erasing art styles. We also study whether the localization hypothesis applies to image styles. We conduct experiments on the styles of 5 famous artists: "Picasso". "Van Gogh", "Rembrandi" "Andy Warhol", and "Caravaggio". For each artist, we generate images with their style from 20 description prompts. We report the I.IPS score of images generated by SD-1.4 and the model created by CAD and other erasing methods in Table 5) Figure (5) illustrates qualitative results of CAD on the target artist and other artists. Overall, our method distorts the style the image while maintaining other styles of the artists. However, for artists with similar styles, such as "Rembrandt" " and " "Caravaggio" " removing one style can affect the other. We hypothesize that some knowledge is not entirely disentangled and some components can be responsible for many concepts.
8

---

Table LPIPS scores of erasing methods on different artist styles. Lower scores indicate more similarity.
Table 6: Ablating negative components identi- fied by CAD significantly increases the prob- ability of generating the target class.
LPIPS on the target artistt
LPPIS on other artists.
Target class
Other classes
Artist
Classes
ESD
RECE
UCE
CAD
ESD
RECE
UCE
CAD
SD-1,4
CAD
SD-1.4
CAD
Picasso
0.143
0.108
0.279
0.077
0.056
0.127
Cassette player
7.20
27.60
86.07
82.42
Van Gogh
0.412
0.253
0.202
0.198
0.303
0.104
0.075
0.089
Chain saw
69.00
98.20
79.20
76.29
Rembrandt
0.417
0.275
0.210
0.320
0.331
0.110
0.084
0.152
Church
76.20
93.80
78.40
74.38
Andy Warhol
0.449
0.321
0.294
0.208
0.276
0.109
0.085
0.056
Gas pump
79.00
94.60
78.09
77.33
Cansaggio
0.394
0.210
0.178
0.243
0.326
0.093
0.073
0.138
Tench
80.40
93.40
77.93
77.56
6.3 Ablating Negative Components Strengthens Knowledge
This section investigates the ability of CAD-Amplify, which based on CAD's attribution framework, to amplify knowledge, when removing the negative components.
Amplify objects. Table shows that Sta- ble Diffusion still struggles to generate some classes, such as "cassette player", "chain saw". "church", "gas pump". To compute the ob- jective in Equation (5), we select 5 images, for each class, from the ImageNette dataset that are correctly classified by the pre-trained ResNet50. We compute the attribution scores and remove the negative components with CAD- Amplify(Algorithm)) (). TTable/]shows that CAD- Amplify improves the accuracy of the target classes significantly. More particularly, the ac- curacy of "cassette player" is increased from 7.2% 27.6%, and those of the other classes are more than 90%. These results indicate the existence of the negative components, verifying Hypothesis
Syrigg
Organa
Chand
Curch
Cloc
CliB mM
Ch
Clii mn
Auplifed
Figure 6: The first row contains generated images conditioned on "church" and "chain saw" but are incorrectly classified by ResNet50. The second row contains images generated from the model in which negative components are ablated, with the same seed as the first row.
We additionally provide qualitative results in Figure to further demonstrate that CAD-Amplify can amplify knowledge. This figure illustrates pairs of images generated by the original model and the ablated model, using the same seeds. As can be observed, CAD-Amplify adds details of the concept to the images, unleashing the target knowledge.
Amplify nudity content. We also investigate how CAD-Amplify (Algorithm 2 increases the probability of generating images with explicit content. Similar to previous experiments, we remove the top 0.1% negative components of the concept "naked" and evaluate on 12P prompts with Nudenet. We also study to what extent other erasing methods remove knowledge, and whether knowledge by ablating negative components with CAD-Amplify. Table 2 illustrates Nudenet's s detections on images generated by the base SD-1.4 and AAp-Amp As can be observed, CAD- Amplify increases the chance of eliciting nudity images, compared to the base model SD-1.4, by removing only small number of parameters.
restore
7 Conclusion
In this work, we study the contribution of each component, i.c., the model parameter, in generating images in diffusion models. We propose framework based on the first-order approximation to efficiently compute the attribution scores and two editing algorithms to erase or amplify knowledge in the diffusion model. Our empirical analysis confirms the localization hypothesis, showing that knowledge is localized in small number of components. We also show the existence of negative components that suppress knowledge, and ablating them increases the probability of generating the target concept. Our study provides a complete view of interpreting diffusion models by analyzing both positive and negative components. This understanding allows us to build more trustworthy and reliable generative models.

---

References
[1] D. Arad, H. Orgad, and Belinkov. ReFACT: Updating text-to-image models by editing the text encoder. In K. Duh, H. Gomez, and S. Bethard, editors, Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume Long Pupers), pages 2537-2558, Mexico City, Mexico, June 2024, Association for Computational Linguistics. doi: 10.18653/v 38653/v1/2024 222024.naacl-oong. URL https::/aaalaathollloe/o
org/ maacl-long 140
[2] S. Basu, N. Zhao, V. I. Morariu, Feizi, and Manjunatha. Localizing and editing knowledge in text-to-image generative models. In The Twelfth International Conference Learning Representations, 2023.
[3] S. Basu, K. Rezaei, P. Kattakinda, V. L. Morariu, N. Zhao, R. A. Rossi, V. Manjunatha, and S. Feizi. On mechanistic knowledge localization in ext-tt--mmaee generative models. In Forty-first International Conference on Machine Learning, 2024.
[4] A. Chattopadhay, A. Sarkar, P. Howlader, and V.N. Balasubramanian. Grad-cam++: Generalized gradient-based visual explanations for deep convolutional networks. In 2018 IEEE winter conference applications of computer vision (WACV), pages 839-847. IEEE, 2018.
[5] R. Chavhan, Li, and T. Hospedales. Conceptprune: Concept editing in diffusion models via skilled neuron pruning. In The Thirteenth International Conference on Learning Representations, 2025.
[6] Z.-Y. Chin, C.-M. Jiang, C.-C. Huang, P.-Y. Chen, and W.-C. Chiu. Prompting-deebuging: Red-teaming text-to-image diffusion models by finding problematic prompts. In International Conference on Machine Learning (ICML), 2024.
[7] A. Conmy, A. Mavor-Parker, A. Lynch, S. Heimersheim, and A. Garriga-Alonso. To- wards automated circuit discovery for mechanistic interpretability. In A. Oh, Nau- mann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, editors, Advances in Neu- ral Information Processing Systems, volume 36, pages 13312-6355.. Curran Associates, Inc., 2023. URL httpitttss//procceeeeeeeee Bee.bbbbdddddeeatffbbbbababb2223 pappsebbbbbbebbbbbbeeeeeeeeee Conf erence. pdf
neurips cc/ wwcpppppr_ffeee files////////o hitppe_iiiie//pppr/2//////// pappr//022/f/ll//
[8] D. Dai, L. Dong, Y. Hao, Z. Sui, B. Chang, and F. Wei. Knowledge neurons in pretrained transformers. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguisties (Volume 1: Long Pupers), pages 8493-8502, 2022.
[9] A. Dravid, Y. Gandelsman, K--C Wang, R. Abdal, G. Wetzstein, A. A. Efros, and K. Aberman. Interpreting the weight space of customized diffusion models. In The Thirty-eighth Annual Conference Neural Information Processing Systems, 2024.
[10] Frankle and M. Carbin. The lottery ticket hypothesis: Finding sparse, trainable neural networks. In International Conference Learning Representations, 2018.
[11] R. Gandikota, J. Materzynska, Fiotto-Kaufman, and D. Bau. Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 2426 2266,, October 2023.
[12) R. Gandikota, H. Orgad, Y. Belinkov, J. Materzyáska, and D. Bau. Unified concept editing in diffusion models. JEEE/CVF Winter Conference on Applications of Computer Vision, 2024.
[13] C. Gong, Chen, Z. Wei, Chen, and Y.-G. Jiang. Reliable and efficient concept erasure of text-to-image diffusion models. In European Conference on Computer Vision, 2024.
[14] S. Han, J. Pool, J. Tran, and W. Dally. Learning both weights and connections for efficient neural network. Advances in neural information processing systems, 28, 2015.
[15] X. Han, S. Yang, W. Wang, Y. Li, and J. Dong- Probing unlearned diffusion models: A transferable adversarial attack perspective, 2024. URI. htttps://aaatt 19382
10

---

[16] Y. Hao, L. Dong, F. Wei, and K. Xu. Self-attention attribution: Interpreting information interactions inside transformer. In Proceedings of the AAAI Conference on Artificial Intellignnce. volume 35, pages 12963-12971, 2021.
[17] P. Hase, M. Bansal, B. Kim, and A. Ghandeharioun. Does localization inform editing? surprising differences in cqusality-baseed localization vs. knowledge editing in language models. Advances in Neural Information Processing Systems, 36, 2024.
[18] J. Ho, A. Jain, and P. Abbeel. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems, 33:6840-6851, 2020.
[19] C. Kim, K. Min, and Y. Yang. R.a.c.e.: Robust adversarial concept erasure for secure text-to- image diffusion model. In European Conference on Computer Vision, 2024.
[20] S. Kim, S. Jung, B. Kim, M. Choi, J. Shin, and J. Lee. Towards safe self-distillation of internet- scale text-to-image diffusion models, 2023. URL httpss///aaaii..rrrr//////////// 2307/09977
[21] N. Kumari, B. Zhang, S.-Y. Wang, E. Shechtman, R. Zhang, and J.-Y. Zhu. Ablating concepts in text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages -22022, 2023.
[22] N. Lee, T. Ajanthan, and P. Torr. Snip: Single-shot network pruning based on connection sensitivity. In International Conference on Learning Representations, 2018.
[23] T.-Y. Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Dollár, and C. L. Zitnick. Microsoft coco: Common objects in context. In Computer Vision-ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pages 740-755. Springer, 2014.
[24] Z. Liu, R. Feng, K. Zhu, Y. Zhang, K. Zheng, Y. Liu, D. Zhao, J. Zhou, and Y. Cao. Cones: concept neurons in diffusion models for customized generation. In Proceedings of the 40th International Conference on Machine Learning, pages 21548-21566 2023.
[25] S. Lu, Z. Wang, L. Li, Y. Liu, and A. W.-K. Kong. Mace: Mass concept erasure in diffu- sion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 1430-6440 June 2024.
[26] C. Luo. Understanding diffusion models: A unified perspective. arXiv:2208.1 11970, 2022.
arXiv preprint
[27] K. Meng, D. Bau, A. Andonian, and Y. Belinkov. Locating and editing factual associations in gpt. Advances in Neural Information Processing Systems, 35:17359-17372, 2022.
[28] P. Molchanov, S. Tyree, T. Karras, T. Aila, and Kautz. Pruning convolutional neural networks for resource efficient inference. In International Conference on Learning Representations, 2017.
[29] H. Orgad, B. Kawar, and Y. Belinkov. Editing implicit assumptions in text-to-image diffusion models. 2023 IEEF/CVF International Conference on Computer Vision (ICCV), pages 7030- 7038, 2023.
[30] M. Pham, K. O. Marshall, N. Cohen, G. Mittal, and C. Hegde. Cireumventing concept erasure methods for text-to-image generative models. In The Twelfth International Conference on Learning Representations, 2024.
[31] Podell Z. English, K. Lacey, A. Blattmann, T. Dockhorn, J. Müller, J. Penna, and R. Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. In The Twelfth International Conference on Learning Representations, 2024.
[32] R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
[33] N. Ruiz, Li, V. Jampani, Y. Pritch, M. Rubinstein, and K. Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In Proceedings of the IEFF/CVF conference computer vision and pattern recognition, pages 22500-22511 2023.
11

---

[34] R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra. Grad-cam: visual explanations from deep networks via gradient-basee localization. International journal of computer vision, 128:336-33 (899, 2020.
[35] H. Shah, A. Ilyas, and A. Madry. Decomposing and editing predictions by modeling model computation. In Forty-first International Conference on Machine Learning, 2024.
[36] J. Sohl-Dickstein, E. Weiss, N. Maheswaranathan, and S. Ganguli. Deep unsupervised learning using nonequilibrium thermodynamies. In International Conference on Machine Learning, pages 2256-2265. PMLR, 2015.
[37] J. Song, C. Meng, and S. Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations, 2021.
[38] M. Sundararajan, A. Taly, and Q. Yan. Axiomatic attribution for deep networks. In International conference on machine learning, pages 3319-3328. PMLR, 2017.
[39] A. Syed, C. Rager, and A. Conmy. Attribution patching outperforms automated circuit discovery.
[40] H. Tanaka, D. Kunin, D. L. Yamins, and S. Ganguli. Pruning neural networks without any data by iteratively conserving synaptic flow. Advances in neural information processing systems, 33: 6377-6389, 2020.
[41] Y.-L. Tsai, C.-Y. Hsu, C. Xie, C.-H. Lin, Y. Chen, B. Li, P.-Y. Chen, C.-M. Yu, and C.-Y. Huang. Ring-a-bell! how reliable are concept removal methods for diffusion models? In The Twelfth International Conference on Learning Representations, 2024.
[42] H. Wang, Z. Wang, M. Du, F. Yang, Z.. Zhang, S. Ding, Mardziel, and X. Hu. Score-cam: Score- weighted visual explanations for convolutional neural networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, pages 24-25, 2020.
[43] K. R. Wang, A. Variengien, A. Conmy, B. Shlegeris, and J. Steinhardt. Interpretability in the wild: a circuit for indirect object identification in GPT-2 small. In The Eleventh International Conference Learning Representations, 2023.
[44] T. Xiong, Y. Wu, E. Xie, Y. Wu, 7. Li, and X. Liu. Editing massive concepts in text-to-image diffusion models, 2024. URL https::///xxii/// org/ /a//a/b///2000 2203. 13807
[45] T. Yang. J. Cao, and C. Xu. Pruning for robust concept erasing in diffusion models, 2024. URL https://arxixs . org/ abs/ 16534
[46] Y. Yang, R. Gao, X. Wang, T.YY Ho, N. Xu, and Q. Xu, Mma-diffusion: Multimodal attack on diffusion models. In Proceedings of the ICEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 7737-7746, June 2024.
[47] Y. Yang, B. Hui, H. Yuan, N. Gong, and Y. Cao. Sneakyprompt: Jailbreaking text-to-image generative models. In Proceedings of the IEEE Symposium on Security and Privacy, 2024.
[48] C. Zhang, M. Hu, W. Li, and L. Wang. Adversarial attacks and defenses on text-to-image diffuusio models: A survey, 2024. URL httpp:://axxi..rrrg.r///
15861
[49] F. Zhang and N. Nanda. Towards best practices of activation patching in language models: Metrics and methods. In The Twelfth International Conference on Learning Representations, 2024.
[50] G. Zhang, K. Wang. X. Xu, Z. Wang, and H. Shi. Forget-me-not: Learning to forget in text-to- image diffusion models. In Proceedings of the JEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, pages 1755-1764, June 2024.
[51] Y. Zhang, J. Jia, X. Chen, A. Chen, Y. Zhang. J. Liu, K. Ding, and S. Liu. To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. In European Conference on Computer Vision 2024.
12

---

This Appendix provides additional details, analysis, and quantitative and qualitative results to support the main paper. Section[AJand and discuss the limitations and societal impacts of our work. We report experimental setups and hyperparameters in Section C Section D shows the performance of CAD on different modules. Section Section[]discussee dldicusses the results CAD with different ablation ratios. We report the computational cost of our method in Section [F] Section G studies the other type of intervention on model components. We present experimental results for Stable Diffusion v2.1, Stable Diffusion XL, and Stable Diffusion v3.5 in Section and additional qualitative results in Section
A Limitations
In this work, only focus on the most fine-graing model components, i.e, the model parameters, and study their contributions to concept generation. We do not examine other types of components, such layers modules, which we study the contribution model components to a concept represented in the generated image, which is the final result of the reverse process in diffusion models. Extending work analyze model attribution to specific stage in the reverse process or spatial location in the image is an interesting direction for future work.
potentially influence multiple concepts at once. Furthermore,
In addition, as our work only focuses on identifying and analyzing positive and negative components in diffusion models, the proposed lightweight erasing and amplification algorithms may not be the most performant. Nevertheless, one can develop more sophisticated approaches, e.g., fine-tuning the highly influential components, that may achieve better concept-editie performance than ours. Again, we leave this for future work.
When removing objects, we observe that CAD-Erase slightly compromises some other knowledge, ie., decreases the accuracies on other classes. This means that although knowledge is generally localized, there could still exist some components of those being removed that are responsible for multiple pieces of knowledge. Studying the entanglement parametric knowledge would be an interesting future direction.
B Societal Impacts
Our work proposes framework that facilitates the analysis of diffusion models and allows to understand how model components work. On the one hand, this framework could be potentially misused induce harmful behaviors in generative models, such as amplifying explicit content or misinformation in generated images. On the other hand, future research could employ our approach safeguard the model by identifying harmful components.
C Experimental Setup
our study, we compare our method with other concept erasure techniques and test its robustness against red-teaming attacks. We conduct the experiments RTX A5000 GPUs. To evaluate erasing methods and prompt attacks, we use their official implementations. We provide details on the hyperparameters and setups used from these methods as follows:
For Stable Diffusion v1.4:
ESD: We follow the setting in the original paper and fine-tune the UNet with learning rate of 1e 5. To compute the objective, we generate images of the target class with a guidance scale of 3. The scale negative guidance in the objective is set 1.
UCE. We apply UCE across ten objects within the Imagenette class and for the artistic styles of Picasso, Van Gogh, Rembrandt, Andy Warhol, and Caravaggio, including the nudity concept. The method includes a "preserve" parameter in artist styles, which retains styles not targeted for erasure. We follow that setting, by erasing only one artist style at each checkpoint while keeping the rest.
RECE. This method continues to fine-tune models using checkpoints previously erased by UCE, We utilize public checkpoints, which are available at athhtts:///uuge h/tg:g/guggggfge To/ChaaGong/// /EECE These checkpoints include models fine-tuned to crase concepts
13

---

such as nudity and Van Gogh style, besides 5 objects such as church, garbage truck, English springer, golf ball, and parachute.
ConceptPrune. We follow the setting provided by the author. Note that the original paper only evaluates SD-v1.5. For the nudity concept, apply mask the initial denoising step with / = 9 and sparsity level of k 1%. For object removal in the Imagenette classes, we use & = 10 and the erasure of artist styles. Additionally, the "select ratio" parameter determines the threshold for applying the binary mask to the model weights. The method prunes only those neurons that exceed m% throughout the initial time steps f. As this parameter is 0.5 balance the removal and retaining ability.
2%. The same parameters are applied to
detailed in their work, we
For Stable Diffusion v2.1:
UCE We conduct the same experiments with Stable Diffusion v1.4 for all the concepts: object, artistic style, and nudity.
RECE. For nudity content, we set À at le - 1. In object removal scenarios where UCE has successfully crased four objects with accuracy of 0.00%, RECE focuses the remaining objects. For the difficult object "church", we use = 1e - 3, and for easy objects like "golf ball", "parachute", "cassette player", "gas pump", , and "garbage truck", we use le - 1. We fine-tune for 10 epochs for nudity and 5 epochs for object removal, consistent with the hyperparameters used in the paper.
For nudity and object evaluation:
We follow the settings in prior studies.
To accelerate the benchmark process, we use a batch size of 16 for Stable Diffusion v1.4 and 8 for Stable Diffusion 12.1. This allows us evaluate using single A5000 GPU. We maintain consistent seed of 0 for all benchmark experiments.
Table 7: The effect of ablating parameters in different modules.
Accuracy the target
Accurnyy other classes
Classes
FF
Atln2
Residual
FF
Atial
Residual
Cassette player
0.40
0.00
2.00
11.60
80.13
59.38
37.44
34.44
Chuin saw
0.00
0.40
13.60
16.00
69.22
44,80
50.13
20.38
Church
1.60
0.80
43.80
3.80
73.49
60.27
39.82
10.20
linglish Springer
71.91
61.96
French horn
4.40
3.00
30.60
46.40
70.87
66.93
51.47
18.93
Garbage truck
2.20
50.71
39.
Gas pump
0.20
8.20
15.60
16:60
67.69
58.51
31.16
40.49
Golf ball
4.20
29.20
61.60
35.20
73.27
69.40
44.80
5,89
Parachute
2,00
3.80
54,20
28.00
68.91
55,96
36.58
14.33
Tench
0.20
0.00
9.60
13.60
72.67
52.27
57.73
12,73
Average
1.82
5.28
25.40
18.96
71.19
58.02
42.33
20.87
D
Ablation Study
In this section, we study our framework in different modules of diffusion models. Specifically, we prune positive parameters in different modules, such as feed-forward layers (FF), self-attention (Attnl), pross-attention(Atn))) and residual connections. Table 7 reports the accuracy of images generated by CAD-Eraseon different modules the erased class and other classes. As can be observed, parameters in modules other than feed-forward layers are highly entangled, removing positive parameters of concept affects other concepts.
E
The Effect of The Ratio of Ablated Components
As mentioned in Section 6 some components may be responsible for many concepts. Thus, ablating too many positive components can lead to degradation in the generation quality of other concepts. To investigate this behavior, evaluate CAD in erasing objects with different numbers of ablated
14

---

Table 8: The accuracy of generated images by SD v2.1 on target classes and other classes, predicted by the pretrained ResNet50 model.
Accuracy target classes]
Accuracy other classest
SD-2.1
CAD-Erase
RECE
CAD-Erase
Cassetie player
15.50
0.20
0.00
0.20
88.22
79.17
69.95
87.38
Chain
98.40
0.00
0.00
1.40
71.95
71.95
71.95
74.40
Church
90.60
23.20
6,80
38.00
79.88
69.97
65.57
81.60
English Springer
French horn
98.80
0.00
0,00
2.40
78.97
74.28
74.28
76.82
Garbage truck
84.00
0.60
0.20
4.20
80.62
74.33
64.17
78.60
Gas pump
90.00
0.20
0,00
6.40
79,95
69.88
57.57
76.98
Golf
93.80
0.20
0.00
1.80
79.53
75.68
64.15
79.22
Parachute
63.20
0.00
0.20
69.64
78.87
Tonch
76.60
0.00
0.00
1.00
81.44
71.42
71.42
78.29
Table The number of nudity content classified by Nudenet on images generated from 12P prompts. We also provide CLIP-Score and FID computed on the COCO dataset to evaluate the quality of generated images on normal prompts.
Model
Armpits
Belly
Buttocks
Feet
Breast
Genitalia (F)
Breast (M)
Genitalia (M)
Anus
Total]
CLIP-Scuref
FID
SD-2.1
232
106
35
116
225
13
761
31.58
12.860
RECE
4
0
7
4
0
2
0
18
29.32
15.760
93
42
48
18
304
31.35
12.785
CAD-Erase
79
19
13
74
73
0
18
277
31.57
12.872
CAD-Amplify
230
106
36
124
240
19
18
786
100%
Avg. Acc. on the erased class
Avg. Acc. on other classes
80%
60%
40%
20%
0%
5e-4
7.5e-4
1e-3
1.5e-3
2e-3
Ablation ratio
Figure 7: The accuracy on CAD with different ablation ratios on the erased class and other classes.
components. Figure F illusstates the accuracy with different ablation ratios, showing that high ratios decrease the accuracy of other classes. However, this drop occurs after the accuracy on the erased class reaches almost 0%, thus, we can expect a high disentanglement of knowledge in the model.
Computational Cost of Our Methods
In this section, we investigate the computation overhead of our editing methods. Since CAD edits diffusion models by only updating their weights once, it does not incur any computational overhead. In addition, as discussed in Section 4 unlike other methods such as ESD, CAD does not require training but instead leverages first-order approximation to efficiently compute model attribution. Therefore, the time and memory for editing are insignificant. We quantify the computational cost of CADand different editing methods in Table I0
We observe that ESD takes significant amount of
15

---

time since it requires training for 1000 epochs. ConceptPrune requires generating several images to collect activations for a single concept, leading to high editing time. UCE and RECE offer fast editing due to the closed-form update; however, for a certain type of knowledge, such artistic styles, they require additional computation to preserve many unrelated concepts. Meanwhile, CAD consumes small amount of computation, enabling scalability to larger models while maintaining zero impact on final inference speed.
Table 10: Time (second) and memory (MB) comparison across editing methods.
Method
Object
Nudity
Artist
Time
Memory
Time
Memory
Time
Memory
ESD
5,691
10,225
5,624
10,233
5,617
10,238
ConceptPrune
230
4,047
294
4.075
321
4,035
RECE
26
15,561
66
15,562
470
15,665
UCE
7,420
7,658
386
8.610
CAD
8,152
8,157
66
8,223
G Intervention by Amplifying Components
Table 11: Intervening diffusion by knocking out or amplifying components.
Accuracy largel classes
Accurayy other classes"
Classes
Amplifying
Knocking out
Amplitying
Knocking out
scalc=1.5
scale=2
scale=3
scale=
scale=2
scalc=3
Cassette player
7.80
0.20
0.00
0.40
86.09
80.11
41 12
81.33
Chuin saw
Church
76.60
1.40
0.00
3.00
78.44
74.47
33.16
74.24
English Springer
606
0.00
76.56
72.22
42.20
French born
98.80
11.40
0.20
0.60
75.98
71.60
$1.18
68.09
Garbage truck
85.60
9.00
0.00
77.44
62.78
27.96
64.73
Gas pump
78.00
0.20
0.00
1.60
78.29
66.71
28.40
66.04
Golf ball
95.80
8.20
1.40
5.40
76.31
73.84
65.13
73.20
Parachute
0.00
76.27
32.49
Tench
80.80
0.00
0.00
0.20
77.98
71.33
29.29
67.93
Average
78.26
3.46
0.16
1.58
78.26
70.64
35.79
70.42
In Section we study the causal effect of model components by removing them from the model. We also perform another intervention that amplifies the effect of model components by rescaling the magnitude of model components. Intuitively, increasing the magnitude of negative components could also suppress the target concept, although knowledge may still exist in positive components. The main problem of this approach is that it's hard to determine the scale for meaningful intervention; choosing a low value may not be enough to erase the target concept, while a high value may affect scaled
other knowledge. We evaluate the performance of the model when model components up by different values. TableI[[rpoon reports the performance when amplifying negative components or knocking out positive components, showing that not all scales suitable verify the role of model components. With an appropriate value, i.e., 2, intervening negative components also remove the target knowledge while retaining other knowledge, confirming the effect of those components.
H Additional Results on Other Diffusion Models
this section, we report the performance of our two algorithms on other diffusion models, including Stable Diffusion 12. Stable Diffusion XI. (31, and Stable Diffusion v3.5 to further support analysis.
H.1 Stable Diffusion v2.1
Erasing objects. Table&Ssoow the accuracy of SD-2.1 erased by Algorithm on the target class and other classes. As can observed, CAD erases the target knowledge significantly while maintaining unrelated knowledge.
16

---

Erasing nudity. Tealueeess CAD in erasing nudity, showing that removing positive components in SD-2.1 also significantly decreases the probability of generating explicit contents and keeps the quality of generated images normal prompts.
Amplifying objects. We also apply Algorithm 2 to amplify knowledge in SD-2.11 Table T2
demonstrates that CAD increases objects in SD-2.I. CAD can also amplify knowledge of explicit contents, as shown in Table 12
Table 12: Ablating negative components on SD-2.1.
Table 13: The CLIP-Score of SD-XL and SD-3.5 with CAD-Erase.
Classes
SD-2.1
CAD
Model
Method
Cassette player
15.60
18.60
SD-3.5
Base model
32.08
Parachute
63.20
96.40
CAD-Erase
30.63
SD-XL
Base model
31.93
CAD-Erase
31.67
H.2 Stable Diffusion XL and Stable Diffusion v3.5
We also evaluate the editing performance on Stable Diffusion XL and Stable Diffusion v3.5. We ablate no more than 0.03% of the model's parameters and measure the number of nudity content in images generated from prompts I2P, Ring-A-Bell, and MMA datasets Table [4 as well as CLIP-Score on COCO30k in Table 13 The results show that in different diffusion models, CAD can locate positive components, and knowledge is still localized. In particular, CAD reduces the number of nudity labels by 97.39% and 98.63% on SD-XL and jailbreaking prompts such Ring-A- A-Bell and MMA datasets, while inducing minimal impact on CLIP-Score. This experiment further indicates the generalization and practicality of our framework.
Table 14: The number of nudity content classified by Nudenet on images generated by SD-XL and SD-3.5 from 12P, Ring-a-bell, and MMA prompts.
Dataset
Method
Armpts
Belly
Buttocks
Feet
Breast (F)
Genitalia (F)
Breast (M)
Genitalia (M) Anus
Total
SD-3.5 Base
158
130
19
41
137
3
16
$14 157 (-69.46%)
SD-3.5 CAD Erase
30
32
3
2
64
5
10
11
12P
SD-XL Base
222
169
32
44
211
14
42
748
SD XI. CAD Eruse
46
9
2
7
19
2
1
95 (-87.309)
SD-3.5 Base
66
73
6
30
110
4
25
314
Ring-A-Bell Bell
3D.3.5
7
30 (-90.45%)
SD-XL Base
106
110
19
33
203
50
16
537
SD-XL CAD Erase
14 (-97.39%)
SD-3.5 Base
96
21
68
49
SD-3.5 CAD Erase
13
6
3
7
2
5
.88 (-90.61%)
MMA
SD-XI, Base
209
185
47
75
212
11
52
12
803
SD XL CAD Eruse
2
0
0
0
0
11 ( (-98.63%)
I Additional Qualitative Results
In this section, we provide additional qualitative results to demonstrate how CAD augments knowl- edge in diffusion models compared to other methods.
Figure illustrates generated images conditioned on sensitive prompts of the original SD-1.4 1.4 and different erasing methods. CAD removes explicit content in the model and maintains the quality on normal prompts.
Figure 9 shows images generated from SD- that has been erased knowledge of "Van Gogh " style by different methods. CAD successfully erases the target art style and maintains the quality of other styles. RECE and UCE also keep knowledge of other styles but change the original content.
17

---

Original SD
ConceptPrune
ESD
RECE
UCE
Ours
Erasure nudity (Prompts from I2P)
Interference with others
Figure 8: Qualitative results of erasing sensitive content in SD-1.4 with CAD. We add for publication. Prompt (1): "High-detail image city skyline at dusk, lights on": Prompt (2): "Hyper- realistic image of car winding road, motion blur": Prompt (3): "Photo of cozy living room with fireplace, warm lighting": Prompt (4): "Realistic depiction of a serene beach at sunset, calm waves".
Figure TO provides generated images after erasing knowledge of objects in SD-2.1 We also show qualitative results of erasing explicit content SD-2.1 in Figure [T
Figure 12 demonstrates how CAD amplifies knowledge in SD-2.1.
18

---

Original SD
ConceptPrune
ESD
RECE
UCE
Ours
(More change is better)
Erasure of artist
Gogh
Picasso
Interference with other artists
(Less change better)
Andy Warhol
Caravaggio
Figure 9: Erasing "Van Gogh" style with different methods.
Original Sh
RICK
UCR
Orr
Original
RKCR
UDR
Ours
(More change hente)
Etonue object
Interoroice with other objesti (Lov change hetter)
In Sprigg Ca Track
Figure 10: Qualitative results of erasing objects in SD-2.1 with CAD.
19

---

Orignaal
Ours
Original SD
RECE
UCB
Ours
(Prompe from E2D)
Figure 11: Qualitative results of erasing sensitive content in SD-2.1 with CAD. We add for publication. Prompt (1): 'Impressionist landscape of a Japanese garden in autumn, with bridge over a koi pond"; Prompt (2): "Art Nouveau painting of female botanist surrounded by exotic plants in greenhouse"; Prompt (3): "Gothic painting of an ancient castle night, with a full moon, gargoyles, and shadows"; Prompt (4): "Black and white street photography of rainy night in New York, reflections on wet pavement";; Prompt (5): "Underwater photography of coral reef, with diverse marine life and scuba diver for scale"; Prompt (6): "Documentary-style photography of bustling marketplace Marrakech, with spices and textiles"; Prompt (7): "Cyberpunk cityscape with towering skyscrapers, signs, and flying cars"; Prompt (8): "Concept art for post-apocalyptic world with ruins, overgrown vegetation, and a lone survivor".
Balloon
Balloon
Umbrella
Bulloon
Thatch
Bulloon
Original
Parachute
Parachute
Parachute
Parachute
Parachute
Parachute
Aamllificd
Figure 12: Qualitative results of amplifying knowledge in SD-2.1 with CAD.
20

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We introduce our framework in Section 4 show how we locate positive and negative components in Section 5 and confirm their roles in Section 6
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
We discuss the limitation in the Appendix.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
21

---

We do not provide any theoretical result; however, we rigorously discuss and prove the assumption our framework in Section T and 6
Justification:
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proof's can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification:
We provide the detail experimental setup in the Appendix.
Guidelines:
The answer NA means that the paper does include experiments. If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility, In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
22

---

Answer: [Yes]
Justification:
We use public datasets and provide the code in the submission.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips... cc/
public//uides//Coeeee http://oooeeaaaaiiiiinneeaa lc for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/ ccpppp.ccppulli//uuuii wwwpc//ggue////eeeeceooc CoodeSubeiiieeee ssi wsionnolli onnolicy)))) for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
We provide the experimental setup in the Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [NA]
Justification:
We fix the seed across our experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, at least for the experiments that support main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
23

---

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of enrors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We conduct experiments on RTX A5000 GPU, mentioned in the Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g.. preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics http:::///euriipee www.eeis....p..u...eeee https////pppp.ttttccccccceeeeeaa
Answer: [Yes]
Justification: NA.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is a special consid- eration due to laws or regulations their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We discuss the societal impacts in the Appendix.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to

---

generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
We do release any dataset.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: cite the datasets and the papers that introduce methods used in our experi- ments.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g.. website). the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, wwwpsspipetattteeeeee thcode. com datasets has curated licenses for some datasets. Their licensing guide can help determine the license dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New assets
25

---

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification:
We provide the code in the supplementary materials.
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the dataset/code/mooel as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember anonymize your assets (if applicable). You either create an anonymized URL or include an anonymized zip file.
Crowdsourcing and research with human subjects
For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Question:
Answer: [NA]
Justification:
There is no crowdsourcing experiment.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: Our research does not involve human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact core methodology, scientific rigorousness, originality of the research, declaration is not required.
26

---

Answer:
[NA]
Justification:
We do not use LLMs at all.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non non-standard components.
Please refer to our LLM policy for what should or should not be described.
cc//omnferences/222551/1.
27


Reviews:
[{"review_id": "IFWY8JpKuO", "reviewer": "Reviewer_tDav", "summary": "This paper describes the use of a linear counterfactual predictor to attibute concept-related capabilities to sets of diffusion model components. It identifies components with activations magnitudes have both positive and negative relationships with the generation of images containing the concept. The component outputs are then modulated to amplify or attenuate the concept.", "questions": "If the contributions were revised to focus on the specific novel contributions of the paper, what would they look like?\n\nDo you claim to be the first to discover that a very small percent of DNN components have nearly all the influence over the expression of a concept?\n\nIs the key novel idea for the counterfactual predictor to use the Taylor series expansion to enable efficient prediction, or is there another primary novel contribution related to the predictor?\n\nDo you claim to be the first to find that there are some components for which higher activations repress a concept?\n\nAre there other novel ideas or discoveries claimed?", "limitations": "Yes.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths\n\nThe approach is highly effective based the experimental evaluation, which is adequate in my opinion.\n\nThe results provide additional evidence that \"knowledge is localized\", although this observation has been made in prior work on attribution and on fairness.\n\nThe authors claim that this is the first work commenting on the existence of and identifying components whose activations are inversely related to the expression of concepts. A brief literature survey supports this claim. This is an important finding that others in the field should  be aware of. \n\nThe presented attribution method requries only a single forward and backward pass in contrast with approaches generating data to learn $\\alpha_c$.\n\nWeaknesses\n\nThe writing quality is a bit poorer than typical for a NeurIPS submission.\n\nDesign decisions are not very well justified, relative to alternatives. For example, the authors make clear that the first-order Taylor series expansion enables a efficient estimation but do not comment on why their chosen approach is likely to do a better job of this than alternatives. More explanation of the reasons for design decisions would improve the paper.", "was_revised": true, "final_justification": "The rebuttals suggest that the final version of the paper will be clearer w.r.t. novelty claims.", "rebuttal": "We are grateful for your insightful comments and for appreciating the effectiveness of our method and the importance of our findings. Please see our response below. \n\n**Q1:** The writing quality is a bit poorer than typical for a NeurIPS submission.\n\n**A:** Thank you for your comment. We will update the writing in the camera-ready version according to the discussion during the rebuttal.\n\n**Q2:** Design decisions are not very well justified, relative to alternatives. For example, the authors make clear that the first-order Taylor series expansion enables an efficient estimation but do not comment on why their chosen approach is likely to do a better job of this than alternatives. More explanation of the reasons for design decisions would improve the paper.\n\n**A:** Thank you for your comment. The alternatives are actually impractical for diffusion models, as discussed in Section 4.2, due to the data construction process. In particular, creating one training sample for the linear estimator requires computing the objective function on the masked model, and we need a high number of samples to train an accurate estimator. For example, [34] constructs 100,000 samples for ResNet50 with 25M parameters; with 859M parameters of SD-1.4, the computational overhead of training the linear estimator becomes extremely high, if not impractical. \n\nFurthermore, both CAD and the linear estimator approach are an approximation of the true objective function, based on the linearity assumption. Section 6.1 shows that CAD yields a high correlation and can approximate the true objective with high accuracy.\n\nFor these reasons, CAD is a much more desirable choice than the existing alternatives.\n\n**Q3:** If the contributions were revised to focus on the specific novel contributions of the paper, what would they look like?\n\nDo you claim to be the first to discover that a very small percent of DNN components have nearly all the influence over the expression of a concept?\n\nIs the key novel idea for the counterfactual predictor to use the Taylor series expansion to enable efficient prediction, or is there another primary novel contribution related to the predictor?\n\nDo you claim to be the first to find that there are some components for which higher activations repress a concept?\n\nAre there other novel ideas or discoveries claimed?\n\n**A:** We'd like to clarify our contributions as follows. First, we propose a framework that helps identify the contribution of model components to generated data. Although the idea of using counterfactual estimator and Taylor approximation has been explored in classification and language models [34,38], applying them to diffusion is challenging due to the reverse process. Our work shows that we can design a suitable objective function such that the approximation is accurate and becomes beneficial for the study in next sections.\n\nSecondly, we utilize our framework to confirm the localization hypothesis. Prior study focuses on coarse-grained components such as layers and conclude that knowledge is distributed amongst UNet and localized in the text encoder. In contrast, we study fine-grained components and pinpoint a small number of parameters that highly contribute to a knowledge, indicating that knowledge is localized.\n\nFinally, we are the first that observe and verify the existence of negative components in diffusion models. These components contribute negatively to a knowledge; in particular, ablating them leads to high generation probability."}, {"review_id": "BaL3Wj3MiW", "reviewer": "Reviewer_RK1V", "summary": "This paper proposes **Component Attribution for Diffusion Models (CAD)**, a method for understanding and analyzing generative diffusion models. The core approach identifies parameters within the model that have a positive or negative influence on specific concepts during generation. The authors posit that only a small subset of parameters are relevant to a given concept. Based on this attribution analysis, they introduce two corresponding algorithms designed to **suppress or enhance** the generation of the target concept. The fundamental attribution mechanism involves **perturbing a parameter \\(w\\) (e.g., setting it towards zero)** and measuring the resulting impact on the presence of concept \\(c\\) in the output image \\(x\\). The effect on concept \\(c\\) is quantified using a **discriminative model**.", "questions": "None", "limitations": "The authors did not provide such analyses.", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "### **Strengths**\n1.  **Engaging Topic:** The analysis of internal mechanisms in Diffusion Models is a highly relevant and important research direction.\n2.  **Solid Background:** The related works section is well-surveyed, establishing a solid context for the addressed problem.\n3.  **Logical Progression:** The method development follows a logically sound, theoretically grounded progression from attribution analysis to practical application (suppression/enhancement).\n\n### **Weaknesses**\n1.  **Unclear Illustrative Figure:** Figure 1 does not effectively illustrate the *method* itself; it primarily presents a *conclusion* (attribution scores), offering limited help in understanding the CAD procedure.\n2.  **Insufficient and Underwhelming Experiments:**\n    *   Experimental validation is notably limited.\n    *   Results lack robustness: Table 1 fails to highlight superior metrics effectively (e.g., via bolding).\n    *   Evaluation is primarily conducted on **low-resolution images**.\n    *   Model Scope Limitation: Only Stable Diffusion 1.4 (SD v1.4) is tested. The conclusions may not generalize to **more advanced and widely used versions like SD2.x or SD3**, which is a significant omission.\n    *   Poor Empirical Performance: Qualitative results are weak. For instance, Figure 3 (rows 1-2) shows that concept \"erase\" significantly alters background information, indicating the method lacks practical advantage and suffers from unintended side effects.\n3.  **Limited Methodological Novelty:** The core attribution technique (perturbing parameters and measuring output change via a classifier) is **fundamentally simple** and bears strong resemblance to well-established gradient/importance-based attribution methods developed over the past decade (e.g., CAM and its numerous derivatives). The novelty contribution is therefore **significantly lacking**.\n4.  **Misleading Terminology:**\n    *   Referring to individual *parameters* as \"Components\" is inaccurate and potentially confusing. \"Component\" typically implies a composed module or functional unit within a network, not a single scalar weight.\n    *   Labeling a *class token* or a *prompt term* as a \"concept\" is inappropriate. In the field, \"concept\" generally denotes a higher-level, often abstract, semantic entity (e.g., learned by adapters like LoRA), distinct from the direct input tokens used here.", "was_revised": true, "final_justification": "Most of my concerns have been resolved. However, I still believe the novelty is somewhat limited. Indeed, CAM modifies input features, this paper modifies 'components'. However, both input and parameters are simply nodes on the computational graph. And there are many works have also investigated the change of parameters. On the other hand, I admit that the authors did provide many efforts on empirical evaluations. Maybe there are researchers that can benefit from the results of this work. Considering all the facts, I decide to raise my final score to 4 but not against for rejection.", "rebuttal": "Thank you for your insightful feedback. Please see our response below.\n\n**Q1:** Figure 1 does not effectively illustrate the method itself; it primarily presents a conclusion (attribution scores), offering limited help in understanding the CAD procedure.\n\n**A:** Fig. 1 illustrates the \"problem statement\" of our work: there exist negative and positive components for each concept, where their ablations result in \"increasing\" or \"decreasing\", respectively, the presence of that concept in the generated image. Thus, it does not illustrate the specific technique used to **identify these components**; please note that the specific proposed algorithms are detailed in Algorithms 1 and 2. We believe this division is clearer to highlight the studied research problem and the proposed algorithmic solution. \n\n**Q2:** Experimental validation is notably limited.\n\nThank you for the comment. However, we'd appreciate it if the reviewer could elaborate the \"limited experimental validation\", as it'd better help us to address your concerns.\n\nIn the paper, we conduct experiments on SD-1.4 and SD-2.1, 10 objects, 5 artist styles, nudity content, 2 black-box attacks, and 2 white-box attacks.  Our experimental validation is extensive, following the setting in prior research [5,11,12,13,19,21,25,43].\n\n**Q3:** Results lack robustness: Table 1 fails to highlight superior metrics effectively (e.g., via bolding).\n\n**A:** We will highlight the best performance method in Table 1 in the final version. We'd also like to note that the main goal of our work is to study the localization hypothesis in diffusion models, rather than proposing a state-of-the-art knowledge erasing method. Table 1 along with other empirical evidence in the paper successfully verify that hypothesis by showing that ablating a small number of parameters removes the target concept while keeping other concepts intact. We believe that future research could utilize our findings to improve knowledge erasing algorithms.\n\n\n**Q4:** Evaluation is primarily conducted on low-resolution images.\n\n**A:** We'd like to clarify that we generate images using **the standard resolution of Stable Diffusion models**, including 512x512 and 768x768 for SD-1.4 and SD-2.1, respectively. These are high resolutions and have also been used in several related studies and benchmarks [5,11,12,13,19,21,25,43,49]. Moreover, we also conduct experiments with image size of 1024x1024 on SD-3.5 and SD-XL below, further confirming the utility of our framework.\n\n**Q5:** Model Scope Limitation: Only Stable Diffusion 1.4 (SD v1.4) is tested\n\n**A:** We'd like to clarify that the experiments in our paper are extensively conducted not only on SD-1.4 (main paper), but also SD-2.1 (appendix), which is mentioned in the reviewer's comment. Meanwhile, existing works also only apply their methods on SD-1.4 [2,11,12,13,19,21,25,43], SD-1.5 [5], and SD-2.1[49]. \n\nWe believe these experiments are sufficiently comprehensive to support our claim and demonstrate the utility of our framework.\n\nNevertheless, we follow the review's suggestion and report the results on SD-3.5 and SD-XL. We ablate no more than 0.03% of the model's parameters and measure the number of nudity content in images generated from prompts in I2P, Ring-A-Bell, and MMA datasets, as well as CLIP-Score on COCO30k. The results show that in different diffusion models, CAD can locate positive components, and knowledge is still localized. In particular, CAD reduces the number of nudity labels by 97.39% and 98.63% on SD-XL and jailbreaking prompts such as Ring-A-Bell and MMA datasets, while inducing minimal impact on CLIP-Score. This experiment further indicates the generalization and practicality of our framework.\n\n| Dataset     | Model | Method     | Armpits | Belly | Buttocks | Feet | Breast (F) | Genitalia (F) | Breast (M) | Genitalia (M) | Anus | Total |\n|-------------|-------|------------|---------|-------|----------|------|------------|---------------|------------|---------------|------|-------|\n| I2P         | SD-3  | Base model |     158 |   130 |       19 |   41 |        137 |             3 |         16 |            10 |    0 |   514 |\n|             |       | CAD        |      30 |    32 |        3 |    2 |         64 |             5 |         10 |            11 |    0 |   157 (-69.46%) |\n|             | SD-XL | Base model |     222 |   169 |       32 |   44 |        211 |            14 |         42 |            14 |    0 |   748 |\n|             |       | CAD        |      46 |     9 |        2 |    7 |         19 |             2 |          1 |             9 |    0 |    95 (-87.30%) |\n| Ring-A-Bell | SD-3  | Base model |      66 |    73 |        6 |   30 |        110 |             4 |         25 |             0 |    0 |   314 |\n|             |       | CAD        |       6 |     7 |        0 |    0 |         14 |             0 |          3 |             0 |    0 |    30 (-90.45%) |\n|             | SD-XL | Base model |     106 |   110 |       19 |   33 |        203 |            50 |         16 |             0 |    0 |   537 |\n|             |       | CAD        |       3 |     1 |        0 |    0 |         10 |             0 |          0 |             0 |    0 |    14 (-97.39%) |\n| MMA         | SD-3  | Base model |     216 |    96 |       51 |   21 |         68 |             1 |         49 |             9 |    0 |   511 |\n|             |       | CAD        |       8 |    13 |        6 |    3 |          7 |             2 |          5 |             4 |    0 |    48 (-90.61%) |\n|             | SD-XL | Base model |     209 |   185 |       47 |   75 |        212 |            11 |         52 |            12 |    0 |   803 |\n|             |       | CAD        |       0 |     2 |        0 |    6 |          0 |             0 |          0 |             3 |    0 |    11 (-98.63%) |\n\n| Model  | Method     | CLIP-Score |\n|--------|------------|------------|\n| SD-3.5 | Base model | 32.08      |\n|        | CAD        | 30.63      |\n| SD-XL  | Base model | 31.93      |\n|        | CAD        | 31.67      |\n\n**Q6:**  Qualitative results are weak. For instance, Figure 3 (rows 1-2) shows that concept \"erase\" significantly alters background information, indicating the method lacks practical advantage and suffers from unintended side effects.\n\n**A:** We'd first like to clarify that the qualitative results are intended to demonstrate the successful removal of the concepts, while showing minimal interference with other concepts. Extensive qualitative results on SD-1.4 (main paper) and SD-2.1 (appendix) verify this property.\n\nSecond, as the diffusion process involves multiple sampling steps, slight variations in the generated images (or their backgrounds) are expected in multiple runs (those with or without ablations). This behavior is consistent across all methods, where the backgrounds change in multiple generations. Nevertheless, the key focus is the successful removal (or reservation) of the concept.\n\nFinally, the quantitative results, based on well-established evaluation processes, clearly demonstrate the performance of the baselines and CAD. In other words, the combination of qualitative and quantitative results consistently highlights the effectiveness of CAD.\n\n\n**Q7:** Limited Methodological Novelty: The core attribution technique (perturbing parameters and measuring output change via a classifier) is fundamentally simple and bears strong resemblance to well-established gradient/importance-based attribution methods developed over the past decade (e.g., CAM and its numerous derivatives). The novelty contribution is therefore significantly lacking.\n\n**A:** As discussed in the Related works, our paper attributes *model components*, which is fundamentally different from prior works such as CAM that attribute the *input features*. Section 4.2 also highlights the significant challenge in model (component) attribution for diffusion (Section 4.2); our proposed algorithm offers a significantly efficient solution to this problem, making it a valuable contribution to the literature.\n\nMore importantly, the primary contribution of this work extends beyond the efficient solution itself -- it provides significant insights into the role of model components in diffusion models. Through CAD, we confirm the localization hypothesis (Section 6.2) and reveal the existence of negative components (Section 6.3), which are missing in prior works.\n\n**Q8:** Misleading Terminology\n\n**A:** In this work, we refer to \"components\" as grouped model parameters [34], such as convolutional filters, attention heads, layers, etc. This definition allows us to work with different levels of granularity, from coarse-grained components such as layers in existing works [2,3] or fine-grained components such as parameters in our paper.\nRegarding the use of \"concept\", we follow the widely accepted definition that has been used in prior works [5,11,12,13,19,21,25,43,49]."}, {"review_id": "pSMTenBM94", "reviewer": "Reviewer_UcXL", "summary": "This paper introduces Component Attribution for Diffusion Model (CAD), an efficient framework for interpreting how parameters in diffusion models generate concepts. The study reveals that concepts are governed by localized \"positive components\" that induce them, and uniquely, \"negative components\" that suppress them. Based on these findings, the paper presents two lightweight, inference-time model editing algorithms: CAD-Erase, which removes concepts by ablating positive components, and CAD-Amplify, which enhances concepts by ablating negative ones. Extensive experiments validate that this approach can effectively and robustly erase or amplify objects, styles, and explicit content while preserving other knowledge.", "questions": "1.On Cost: Please quantify the practical overhead (inference speed, memory) compared to baseline.\n\n2.On Generalizability: How does the \"localization hypothesis\" generalize to newer architectures like SD3 or FLUX? We suggest adding theoretical reasoning or a preliminary analysis.\n\n3.On Optimization: Could the method of directly setting ablating parameters to zero be optimized other than finetuning?", "limitations": "yes, authors addressed the limitations and potential negative societal impact of their work", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n- State-of-the-Art Performance: Achieves SOTA or highly competitive results across diverse benchmarks.\n- Demonstrated Robustness to Attacks: The paper shows that CAD is more robust to white-box attacks than many competing methods.\n\nWeaknesses:\n- No Overhead Analysis: Lacks analysis of the practical computational cost (time, memory) for editing and its effect on the final model's inference speed.\n- Uncertain Generalizability: Experiments are confined to Stable Diffusion 1.4(mostly) and 2.1, leaving its effectiveness on other architectures (like SDXL, SD3) unproven.\n- Crude Intervention Method: The approach of ablating parameters by setting them to zero is a blunt instrument. While effective, it might not be optimal.", "was_revised": true, "final_justification": "Most of my concerns have been resolved. I will raise the rating.", "rebuttal": "We are grateful for your helpful comments. Please see our response below.\n\n**Q1:** No Overhead Analysis\n\n**A:** We'd like to clarify that CAD as well as other erasing methods edit diffusion models by only updating their weights, and this process is performed a single time only. Therefore, CAD  has no impact on inference speed and memory. Furthermore, CAD does not require training, unlike other methods such as ESD; thus, the time and memory overhead for editing is insignificant.\n\nNevertheless, we follow the review's suggestion and measure the computational cost for editing the model. We conduct experiments on a single A5000 GPU. We observe that ESD takes a significant amount of time since it requires training for 1000 epochs.  ConceptPrune requires generating several images to collect activations for a single concept, leading to high editing time. UCE and RECE offer fast editing due to the closed-form update; however, for a certain type of knowledge such as artistic styles, they require additional computation to preserve many unrelated knowledge. Meanwhile, CAD consumes a small amount of computation, enabling scalability to larger models while maintaining **zero** impact on final inference speed.\n\n| Method            | Object                     |                    | Nudity                     |                    | Artist                     |                    |\n|-------------------|----------------------------|--------------------|----------------------------|--------------------|----------------------------|--------------------|\n|                   | Time (sec) | Memory (MB) | Time (sec) | Memory (MB) | Time (sec) | Memory (MB) |\n| **ESD**           | 5,691       | 10,225       | 5,624       | 10,233       | 5,617       | 10238       |\n| **ConceptPrune** | 230        | 4,047        | 294        | 4,075        | 321        | 4035        |\n| **RECE**          | 26         | 15,561       | 66         | 15,562       | 470        | 15665       |\n| **UCE**           | 9          | 7,420        | 19         | 7,658        | 386        | 8610        |\n| **CAD**           | 66         | 8,152        | 65         | 8,157        | 66         | 8223        |       |      |\n\n\n**Q2:** Experiments are confined to Stable Diffusion 1.4(mostly) and 2.1, leaving its effectiveness on other architectures (like SDXL, SD3) unproven. How does the \"localization hypothesis\" generalize to newer architectures like SD3 or FLUX? We suggest adding theoretical reasoning or a preliminary analysis.\n\n**A:** We'd like to note that our experimental setup follows existing works that apply their methods on SD-1.4 [2,11,12,13,19,21,25,43], SD-1.5 [5], and SD-2.1 [49], making our evaluation quite extensive compared to these works. Nevertheless, we follow the review's suggestion and report the results on SD-3.5 and SD-XL. We ablate no more than 0.03% of the model's parameters and measure the number of nudity content in images generated from prompts in I2P, Ring-A-Bell, and MMA datasets, as well as CLIP-Score on COCO30k. The results show that in different diffusion models, CAD can locate positive components, and knowledge is still localized. In particular, CAD reduces the number of nudity labels by 97.39% and 98.63% on SD-XL and jailbreaking prompts such as Ring-A-Bell and MMA datasets, while inducing minimal impact of CLIP-Score. This experiment further indicates the generalization and practicality of our framework.\n\nRegarding the theoretical reasoning of the localization hypothesis, we believe that it could be a result of the training process on over-parameterized models. Theoretically studying its origin is an interesting direction, yet it deserves a separate intensive study, and we leave it to future work.\n\n\n| Dataset     | Model | Method     | Armpits | Belly | Buttocks | Feet | Breast (F) | Genitalia (F) | Breast (M) | Genitalia (M) | Anus | Total |\n|-------------|-------|------------|---------|-------|----------|------|------------|---------------|------------|---------------|------|-------|\n| I2P         | SD-3  | Base model |     158 |   130 |       19 |   41 |        137 |             3 |         16 |            10 |    0 |   514 |\n|             |       | CAD        |      30 |    32 |        3 |    2 |         64 |             5 |         10 |            11 |    0 |   157 (-69.46%) |\n|             | SD-XL | Base model |     222 |   169 |       32 |   44 |        211 |            14 |         42 |            14 |    0 |   748 |\n|             |       | CAD        |      46 |     9 |        2 |    7 |         19 |             2 |          1 |             9 |    0 |    95 (-87.30%) |\n| Ring-A-Bell | SD-3  | Base model |      66 |    73 |        6 |   30 |        110 |             4 |         25 |             0 |    0 |   314 |\n|             |       | CAD        |       6 |     7 |        0 |    0 |         14 |             0 |          3 |             0 |    0 |    30 (-90.45%) |\n|             | SD-XL | Base model |     106 |   110 |       19 |   33 |        203 |            50 |         16 |             0 |    0 |   537 |\n|             |       | CAD        |       3 |     1 |        0 |    0 |         10 |             0 |          0 |             0 |    0 |    14 (-97.39%) |\n| MMA         | SD-3  | Base model |     216 |    96 |       51 |   21 |         68 |             1 |         49 |             9 |    0 |   511 |\n|             |       | CAD        |       8 |    13 |        6 |    3 |          7 |             2 |          5 |             4 |    0 |    48 (-90.61%) |\n|             | SD-XL | Base model |     209 |   185 |       47 |   75 |        212 |            11 |         52 |            12 |    0 |   803 |\n|             |       | CAD        |       0 |     2 |        0 |    6 |          0 |             0 |          0 |             3 |    0 |    11 (-98.63%) |\n\n| Model  | Method     | CLIP-Score |\n|--------|------------|------------|\n| SD-3.5 | Base model | 32.08      |\n|        | CAD        | 30.63      |\n| SD-XL  | Base model | 31.93      |\n|        | CAD        | 31.67      |\n\n\n**Q3:** The approach of ablating parameters by setting them to zero is a blunt instrument. While effective, it might not be optimal. Could the method of directly setting ablating parameters to zero be optimized other than finetuning?\n\n**A:** Thank you for the interesting suggestion. \nOur work aims to answer the research question \"how do components in diffusion models contribute to a generated concept?\" -- thus, we focus on directly ablating the identified components as a means to validate their roles. More specifically, CAD can locate positive and negative components of a knowledge, confirmed by their ability to \"edit\" knowledge in diffusion models via ablation. Importantly, the implications of our work go beyond ablation; for example, as you suggested, existing finetuning unlearning approaches could potentially be combined with these components to further improve the unlearning ability. We leave these promising applications as future extensions of our work."}, {"review_id": "lltUxIj9lY", "reviewer": "Reviewer_Yq3z", "summary": "The authors propose a novel framework, Component Attribution for Diffusion Model (CAD), to interpret how individual model parameters in diffusion models contribute to generating specific concepts (e.g., objects, styles, or explicit content). By leveraging a first-order approximation to compute attribution scores, the authors identify both positive (concept-inducing) and negative (concept-suppressing) components. They further introduce two inference-time editing algorithms, CAD-Erase and CAD-Amplify, to respectively remove or enhance specific concepts in generated images.", "questions": "While the paper introduces parameter-level attribution and negative components, these contributions are incremental rather than transformative. The framework builds on existing methods like causal tracing [2, 3, 27] and linear counterfactual estimation [34], with the primary novelty being the identification of negative components. However, this finding is underexplored, and the overall approach does not sufficiently distinguish itself from prior interpretability work in generative models. The editing algorithms, while practical, are similar in spirit to existing methods like ConceptPrune and UCE, reducing the paper’s originality.\n\nWhile the paper claims novelty in identifying negative components and parameter-level attribution, the core idea of attributing model components builds heavily on prior work like Shah et al. [34] and knowledge localization studies [2, 3, 27]. \n\nThe main score and formulation used (Eq. 4) is not novel [21,27] as acknowledged by the authors.\n \nThe discovery of negative components, while interesting, lacks sufficient exploration to establish its significance or differentiate it from existing interpretability frameworks. The paper does not convincingly demonstrate that CAD provides a transformative advance over established methods.\n\nWeak Theoretical Foundation: The reliance on a first-order approximation for attribution scores (Section 4.2) is empirically validated (Figure 2) but lacks theoretical grounding. The paper explicitly notes the absence of theoretical results (Page 13), and the justification for the approximation’s generalizability is insufficient. Without a deeper analysis of its limitations, the method’s reliability across diverse models and concepts remains questionable.\n\nIncomplete Analysis of Negative Components: The identification of negative components is a key claim, but the paper provides minimal insight into their nature, origin, or role in diffusion models. For example, it is unclear whether these components are training artifacts or intentional suppressors, and their distribution across model layers is not explored. This limits the theoretical and practical impact of the finding.\n\nNarrow Experimental Scope: The evaluation is limited to Stable Diffusion-1.4, which raises concerns about generalizability to other diffusion models or newer variants. The paper does not discuss challenges or adaptations needed for applying CAD to other architectures, undermining its broader applicability.\n\nConcept Entanglement Issues: The paper notes that erasing one concept (e.g., Rembrandt’s style) can affect similar concepts (e.g., Caravaggio’s style, Page 8), indicating entanglement in parameter contributions. This issue is acknowledged but not systematically analyzed or addressed, limiting the practical utility of CAD-Erase for complex or overlapping concepts.\n\nLack of Statistical Rigor: The paper fixes seeds for experiments (Page 15) but does not report error bars, confidence intervals, or statistical significance tests for key metrics (e.g., accuracy, FID, LPIPS). This weakens the reliability of comparisons with baselines and the robustness of the claims.", "limitations": "Yes", "rating": 2, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths: \n\n1. Focus on Parameter-Level Analysis: The paper's emphasis on fine-grained, parameter-level attribution is a step beyond layer-based analyses common in prior work. This granular approach could potentially offer deeper insights into diffusion model mechanics.\n\n2. Practical Applications: The proposed CAD-Erase and CAD-Amplify algorithms provide practical tools for concept manipulation, with potential applications in content moderation (e.g., erasing nudity) and enhancing underrepresented concepts.", "was_revised": true, "final_justification": "I appreciate the additional experiments presented in the rebuttal, as well as the inclusion of error bars in the tables. However, I continue to believe that the contribution of this work remains limited in terms of novelty and the overall scope of the effort.", "rebuttal": "We really appreciate your insightful comments. Please see our response below.\n\n**Q1:** While the paper introduces parameter-level attribution and negative components, these contributions are incremental rather than transformative.\n\n**A:** We'd like to clarify the contributions of our paper compared to the literature. Previous works on localizing knowledge in diffusion [2,3] focus on coarse-grained components such as layers, thus, may over-generalize and misinterpret their roles. For example, [2] concludes that knowledge is distributed amongst UNet and localized in text-encoder. On the other hand, since our framework focuses on fine-grained components, we confirm the localization hypothesis and show that knowledge is localized in a small number of parameters (Section 6.2). \n\nSecondly, although Shah et al. [34] explore the linear counterfactual estimator, they only apply it to classification models. As discussed in Section 4.2, this approach is inefficient and challenging for diffusion models. Our work leverages first-order approximation, showing that it could accurately approximate the objective (Section 6.1) without expensive computational overhead and help us locate positive and negative components.\n\nFinally, the primary goal of our framework is to identify positive and negative components, which is distinctive from methods that erase knowledge from the model, such as ConceptPrune and UCE. In particular, ConceptPrune removes model parameters based on feature norms, while UCE updates the projection matrix with a closed-form solution. In contrast, by computing the attribution score, we show that there are parameters contributing positively or negatively to a knowledge, and ablating them from the model leads to the inverse effect. \n\n**Q2:** the core idea of attributing model components builds heavily on prior work like Shah et al. [34] and knowledge localization studies [2, 3, 27]. The main score and formulation used (Eq. 4) is not novel [21,27] as acknowledged by the authors.\n\n**A:** As discussed in the previous answer, our work offers an advanced methodology compared to [34] and provides novel insights compared to [2,3,27].\n\nAlthough prior works have explored Eq. 4, they directly fine-tune the model to minimize that objective. In contrast, we show that Eq. 4 could be used to identify positive components, which is interesting and hasn't been observed. This property facilitates the proof of the localization hypothesis, which is the main contribution of our paper.\n\n**Q3:** The discovery of negative components, while interesting, lacks sufficient exploration.\n\n**A:** We'd like to highlight that the primary objective of our work is seeking a principled framework to answer the question of \"how do components in diffusion models contribute to a generated concept?\", and the \"discovery of negative component\" is a significant finding, but not a focus, of the paper. Specifically, we propose the first-order, inexpensive approximation to locate important components (specifically, parameters -- the most fine-grained components), confirm the localization hypothesis, and empirically validate the utility of these components; these contributions are novel and important in understanding diffusion models, and distinct from existing interpretability papers. \n\nWe agree with the reviewer that the intensive exploration of negative components would be important, but it is beyond the already extensive scope of our work. For example, one can study how to fine-tune these negative components for better editing results, which can be, by itself, a self-contained work. We thus leave these explorations for future work.\n\n**Q4:** Weak Theoretical Foundation.\n\n**A:** In our study, we only focus on a small number of parameters, and ablating them induces an insignificant change in the input $w$ of the objective $J(c,w)$. As discussed in Section 4.2, this assumption makes the first-order approximation *theoretically accurate*, and we empirically validate that in Section 6.1 as well as extensive experiments where we ablate positive and negative components of several concepts on SD-1.4 and SD-2.1.\n\nWhile theoretical analysis is desirable, both reliance on the well-established first-order approximation (with valid assumptions) and rigorous empirical confirmation of the approximation would strongly justify the soundness of our framework. Coupled with the extensive empirical observation, the framework is expected to generalize to other models and concepts. Nevertheless, we would be happy to address any specific suggestions the reviewer may have regarding the theoretical analysis that the reviewer believes is necessary.\n\n**Q5:** Incomplete Analysis of Negative Components.\n\n**A:** Thank you for your suggestion. As mentioned above, our paper is the *first work* that points out the existence of negative components and their *roles*, i.e., ablating them enhances knowledge in diffusion. We believe that theoretically studying their origin during the training process is an interesting direction, yet it deserves a separate intensive study, and we leave it to future work (please also see our response to Q3 on the paper's objective and contributions). \n\n**Q6:** Narrow Experimental Scope: The evaluation is limited to Stable Diffusion-1.4\n\n**A:** We'd like to clarify that the experiments in our paper follow standard evaluation in the literature and are extensively conducted not only on SD-1.4 (main paper), but also SD-2.1 (appendix). Meanwhile, existing works also only apply their methods on SD-1.4 [2,11,12,13,19,21,25,43], SD-1.5 [5], and SD-2.1[49]. This makes our evaluation already more extensive than these related works.\n\nNevertheless, we follow the review's suggestion and report the results on SD-3.5 and SD-XL. We ablate no more than 0.03% of the model's parameters and measure the number of nudity content in images generated from prompts in I2P, Ring-A-Bell, and MMA datasets, as well as CLIP-Score on COCO30k. The results show that in different diffusion models, CAD can locate positive components and knowledge is still localized. In particular, CAD reduces the number of nudity labels by 97.39% and 98.63% on SD-XL and jailbreaking prompts such as Ring-A-Bell and MMA datasets, while inducing minimal impact on CLIP-Score. This experiment further indicates the generalization and practicality of our framework.\n\n| Dataset     | Model | Method     | Total         |\n|-------------|-------|------------|---------------|\n| I2P         | SD-3  | Base model | 514           |\n|             |       | CAD        | 157 (-69.46%) |\n|             | SD-XL | Base model | 748           |\n|             |       | CAD        | 95 (-87.30%)  |\n| Ring-A-Bell | SD-3  | Base model | 314           |\n|             |       | CAD        | 30 (-90.45%)  |\n|             | SD-XL | Base model | 537           |\n|             |       | CAD        | 14 (-97.39%)  |\n| MMA         | SD-3  | Base model | 511           |\n|             |       | CAD        | 48 (-90.61%)  |\n|             | SD-XL | Base model | 803           |\n|             |       | CAD        | 11 (-98.63%)  |\n\n| Model  | Method     | CLIP-Score |\n|--------|------------|------------|\n| SD-3.5 | Base model | 32.08      |\n|        | CAD        | 30.63      |\n| SD-XL  | Base model | 31.93      |\n|        | CAD        | 31.67      |\n\n**Q7:** Concept Entanglement Issues.\n\n**A:** The main contribution of CAD is to confirm the localization hypothesis and the existence and utility of negative components, which is significant and hasn't been explored in prior studies. The effect of different concepts and their entanglement, despite being interesting, is an orthogonal direction to our framework and requires an independent study that is beyond the scope of this work. \n\n**Q8:** Lack of Statistical Rigor.\n\n**A:** Our evaluation follows exactly the experimental setup in existing research [5,11,12,13,19,21,25,43,49]. In particular, to evaluate the knowledge of objects and artistic styles, we generate images from several prompts and random seeds *provided in the dataset*. This evaluation helps reduce the randomness in the result. To evaluate the knowledge of nudity content, we generate with a fixed seed on several datasets (I2P, Ring-A-Bell, MMA) with massive prompts (31285 in total) that assess every aspect of the knowledge. This high number of evaluation prompts provides a reliable verification of our claims.\n\nWe also evaluate knowledge of nudity content in the base Stable Diffusion, ConceptPrune, and CAD with 5 different random seeds and provide the mean and standard deviation of the number of nudity labels. The table confirms that ablating positive components found by CAD indeed erases the knowledge from the model.\n\n|   Dataset   |     Method    |      Total     |\n|----------|-------------|--------------|\n| I2P         | Baseline      | 699.8 ± 302.9  |\n|             | Concept Prune | 85.4 ± 37.5    |\n|             | CAD           | 55.2 ± 12.8    |\n| Ring-A-Bell | Baseline      | 444.8 ± 44.7   |\n|             | Concept Prune | 99.6 ± 40.1    |\n|             | CAD           | 4.2 ± 1.5      |\n| MMA         | Baseline      | 1715.4 ± 394.5 |\n|             | Concept Prune | 94.8 ± 27.3    |\n|             | CAD           | 113.8 ± 31.2   |"}]

Author rebuttal:

Meta-review: The paper proposes Component Attribution for Diffusion Models (CAD), a framework for interpreting and editing diffusion models at the parameter level. CAD identifies positive components (promoting concept generation) and negative components (suppressing concepts). Leveraging these, the authors introduce two inference-time editing algorithms: CAD-Erase (to remove concepts) and CAD-Amplify (to enhance them). 

The topic is timely, and better understanding inner workings of diffusion model is important. Reviewer scores and opinions are spread. As for the weaknesses, the method itself is not very novel and the experiment/analysis of the CAD-Erase and CAD-Amplify can be improved as clearly pointed out by reviewer Yq3z. Nonetheless, the findings on negative components and observation of localization can be useful for the research community and the other three reviewers concluded with positive scores after extensive rebuttals. Therefore, an acceptance is recommended.
Decision: Accept (poster)