CURE: Concept Unlearning via Orthogonal Representation Editing in Diffusion Models
Authors: Shristi Das Biswas
Arani Roy
Kaushik Roy
Venue: NeurIPS 2025 spotlight ()
Keywords: Concept Removal
Text-to-Image Models
Primary area: applications
TL;DR: CURE presents a training-free framework for fast, reliable concept unlearning in diffusion models for targeted artistic styles, objects, identities, or explicit content, that is robust against red-teaming attacks.

Abstract: As Text-to-Image models continue to evolve, so does the risk of generating unsafe, copyrighted, or privacy-violating content. Existing safety interventions - ranging from training data curation and model fine-tuning to inference-time filtering and guidance - often suffer from incomplete concept removal, susceptibility to jail-breaking, computational inefficiency, or collateral damage to unrelated capabilities. In this paper, we introduce CURE, a training-free concept unlearning framework that operates directly in the weight space of pre-trained diffusion models, enabling fast, interpretable, and highly specific suppression of undesired concepts. At the core of our method is the Spectral Eraser, a closed-form, orthogonal projection module that identifies discriminative subspaces using Singular Value Decomposition over token embeddings associated with the concepts to forget and retain. Intuitively, the Spectral Eraser identifies  and isolates features unique to the undesired concept while preserving safe attributes. This operator is then applied in a single step update to yield an edited model in which the target concept is effectively unlearned - without retraining, supervision, or iterative optimization. To balance the trade-off between filtering toxicity and preserving unrelated concepts, we further introduce an Expansion Mechanism for spectral regularization which selectively modulates singular vectors based on their relative significance to control the strength of forgetting. All the processes above are in closed-form, guaranteeing extremely efficient erasure in only $2$ seconds. Benchmarking against prior approaches, CURE achieves a more efficient and thorough removal for targeted artistic styles, objects, identities, or explicit content, with minor damage to original generation ability and demonstrates enhanced robustness against red-teaming. Project Page at \url{https://sites.google.com/view/cure-unlearning/home}.

CURE: Concept Unlearning via Orthogonal Representation Editing in Diffusion Models
Shristi Das Biswas", Arani Roy", Kaushik Roy Purdue University {sdasbisw, roy173, xaushik)Jpurruue.ee
Brasing Artistic Btyle
Brasing Objeeta
"tedttrcyy Oner the Thtte Vitueetd van unoi
Remove
Remove Garbage Truck
Van Goghi
Laedaaeee MeTTE ofrasiins
Remove
Remove
Van Goyh
Garbage
Truck
Brasing Identity
Brasing Nudity
Weuthh bettrous ondunttd
"A partoutt. Simcna Stocel
Remove
Emuaa
Stone
Nudity
po Romn Nicketo
Remove
Emaa
Remove Nudity
Stone
SDL,4
CURE
SD1.4
CURE
Figure 1: Our method, CURE, enables robust and efficient erasure of any target concept in text-to- image models through orthogonal closed-form editing of crossaatenniion weights, ensuring that the unintended concepts remain intact, even if they share common terms with the target concept (seen in the bottom-left sample). This can safeguard celebrity portrait rights, respect copyrights on artworks, and prevent explicit or unwanted content creation in a training-free manner with high efficacy.
Abstract
As Text-to-Image models continue to evolve, so does the risk of generating unsafe, copyrighted, or privacy-violaing content. Existing safety interventions ranging from training data curation and model fine-tuning to inference-time filtering and guidance often suffer from incomplete concept removal, susceptibility to jail- breaking, computational inefficiency, or collateral damage unrelated capabilities. In this paper, we introduce CURE, training-free concept unlearning framework that operates directly the weight space of pre-trained diffusion models, enabling fast, interpretable, and highly specific suppression of undesired concepts. At the core of our method the Spectral Eraser, a closed-form. orthogonal projection module that identifies discriminative subspaces using Singular Value Decompo- sition over token embeddings associated with the concepts to forget and retain. Intuitively, the Spectral Eraser identifies and isolates features unique to the unde- sired concept while preserving safe attributes. This operator is then applied in a single step update yield an edited model in which the target concept is effectively
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

unlearned without retraining, supervision, or iterative optimization. To balance the trade-off between filtering toxicity and preserving unrelated concepts, we further introduce an Expansion Mechanism for spectral regularization which selec- tively modulates singular vectors based on their relative significance to control the strength of forgetting. All the processes above are in closed-form guaranteeing ex- tremely efficient erasure in only seconds. Benchmarking against prior approaches, CURE achieves a more efficient and thorough removal for targeted artistic styles, objects, identities, or explicit content, with minor damage to original generation ability and demonstrates enhanced robustness against red- eedttemming Project Page at https://sittes https/ttessooggll...eeeeooooooos cww/ciooiissseeee cure- unlearning home.
1 Introduction
Recent Text-to-Image (T2I) diffusion models have garnered significant attention for their ability to synthesize high-quality, diverse images across a wide range of prompts 2
(). These
capabilities arise from training on large-scale, uncurated internet datasets (7). which inadvertently expose models to undesirable concepts (8), such as copyrighted artistic styles @ [C II (2),
deepfakes 13 [4] or inappropriate content (15 [6). Such risks underscore the need for principled concept unlearning solutions to eliminate harmful, copyright-enforee enabling safer and more responsible deployment of generative models.
or offensive knowledge,
natural first step in improving safety in generative models to curate training data to exclude undesirable content (17). However, retraining large models and re-annotating datasets to meet evolving safety standards is prohibitively expensive (88), and data filtering alone often leads to unintended consequences: removing one type of undesired content can expose other undesired content (1), introduce new biases (20), or result in incomplete removal (1I, highlighting the limitations of data curation alone. To tackle these challenges, recent research has incorporated safety mechanisms into diffusion models. Safeguarding methods apply safety checkers to censor outputs (22), or steer generation away from unsafe concepts using classifier-free guidance and prompt filtering (66 23}. However, these approaches introduce recurring computational overheads as guardrails must be applied for every new prompt runtime, leading to quality degradation in cases of prompts subjected to hard filtering due to distribution shift. Furthermore, they are easily circumvented in open source settings where model code and parameters are publicly accessible (24 25). In response to the drawbacks mentioned above, an alternative is to unlearn undesirable concepts from T2I models by fine-tuning their parameters (26
29 30 BT Given undesirable concept, these methods
aim to prevent the generation of undesirable content by updating the model's 's internal representations. Compared to full retraining or inference-time interventions, unlearning concepts by removing their knowledge from the model weights offers a more efficient and tamper-resistant solution, especially in open-source settings. However, most existing approaches require numerous fine-tuning iterations over large parameter subsets (27 28; (2)), leading to substantial computational cost and degradation in the model's 'ss general generation quality, A compelling solution to address the above issues is offered by model editing frameworks (32 33 35) which modify model weights in closed-form to enhance safety without the previous overheads of gradient- based fine-tuning. While more efficient, these methods often fail to completely suppress targeted inappropriate concepts, remaining vulnerable to adversarial prompts uncovered through red- red-teaming (36] 37 38), which can trigger the regeneration of supposedly 'forgotten" content in the unlearned model. Thus, there is urgent need for an efficient and reliable mechanism to ensure safe visual generation across a wide range of contexts.
Motivated by the geometric relationship between embedding and weight spaces in diffusion models, this paper presents CURE, a mathematically principled and efficient framework for reliably eras- ing undesired concepts in a single-step update. Building upon prior efficient concept unlearning methods that apply closed-fornt solutions modify diffusion model layers, CURE advances these approaches by explicitly exploiting orthogonal geometric structures derived through Singular Value Decomposition (SVD) (39 40). Specifically, we propose the Spectral Eraser, flosed-form spectral operator that constructs discriminative subspaces by decomposing token embeddings into orthogonal subspaces associated with concepts designated for removal, 'forget concepts," and those intended to be preserved, 'retain concepts'. By translating the derived embedding into weight-space modifications, the Spectral Fraser precisely removes directions uniquely tied to harmful or undesired concepts while preserving the semantic integrity of overlapping and unrelated
projections directly
2

---

representations. Furthermore, to flexibly control the extent of concept removal, we integrate singular- value expansion strategy, inspired by Tikhonov regularization from classical inverse prob- lems 44 22 This mechanism selectively scales singular vectors based on their normalized spectral energies, emphasizing or de-emphasizing the discriminative-nss of the derived forget and retain subspaces. Consequently, such spectral regularization achieves mathematically interpretable and precise trade-off' between effective concept removal and preservation of unrelated capabilities. All updates within CURE are performed in closed-form, ensuring exceptional computational efficiency, with robust concept removal in approximately 2 seconds. Our contributions are summarized as:
We present CURE, a strong, scalable and training-free concept unlearning method leveraging orthogonal projections and spectral geometry. to yield closed-form weight update operator, dubbed Spectral Eraser, for reliable and responsible visual content creation T2I models.
CURE introduces a selective singular-value Expansion Mechanism, grounded in classical regularization theory, to balance robust concept suppression and semantic preservation.
Extensive experiments demonstrate that CURE effectively and robustly removes unsafe content, artist-specific styles, object and identities. It significantly outperforms existing training- based and training-free methods in terms of generation quality, efficiency, specificity, and resistance to adversarial red-teaming tools for both single- and multi-concept removals.
2
Related Works
Concept Unlearning Existing approaches for removing undesired concepts in T2I models primar- ily fall into three distinct categories. The first class focuses on post-hoc, inference-tine control, leveraging safety checkers (22) or classifier-free guidance during generation (66 44). Similarly, (23) operates without modifying weights, filtering the embeddings away from identified unsafe subspaces and attenuating harmful latent features during denoising. However, these soft intervention strategies can be easily circumvented by malicious users in open-source settings where the model architectures and parameters are publicly available (24) and require independent safeguarding operations for every new prompt, hindering inference-time efficiency. The second category involves training-based where the model is retrained on filtered datasets, finetuned using 26), or makes attempts minimize the KL divergence between unwanted and alternative safe concepts (29) to suppress unsafe generations. Adversarial training
interventions (45) 46
47
48
negative guidance 30
27
49
frameworks such as (50) neutralize harmful text embeddings while works like (51 522) remove
unwanted representations through preference optimization. Latent space manipulation, explored enhance safety using superviud learning. On the other hand, partial parameter finetuning approaches adjust specific layers to forget or suppress undesired concepts (31, (28). Al-
by (53 54)
though effective in removing specific knowledge from the model, these methods are computationally expensive, require extensive data curation, cause performance degradation, and are easily bypassed by red-teaming tools for T2I diffusion models (55). Combining the benefits the earlier categories the third direction proposing training- free strategies that adjust model behavior without retraining to crase specific concepts from model weights. Techniques like (35 34) perform projection- based model editing in the attention layers whereas (32) applies minimal parameter updates to diffusion models to remove harmful content while preserving generative capacity. However, these methods often lack robustness against adversarial prompts and fail to show persistent unlearning. Taking inspiration from class unlearning and continual learning approaches for non -onneerert models that have leveraged the benefits of orthogonal representations to remove and add tasks to model's learnt representation, respectively (56) (57), we formulate our approach in a similar stride, exploring orthogonal concept erasure in T21 models guarantee efficient unlearning.
Red-Teaming Attacks for T21 Diffusion Models As safety mechanisms become more preva- lent, recent works have explored adversarial attacks (58) 59) and jail-breaking (60) to evaluate the robustness of unlearned T2I models. White-box attacks like (38) (6) exploit the classification capacity or coonpt-cnniiioone behavior of diffusion models to revive erased concepts. In contrast, black-box box methods like (37 use evolutionary algorithms to generate adversarial prompts or exploit text embeddings and multimodal inputs bypass safeguards (62). These tools reveal critical vulnera- bilities in concept removal approaches when deployed in unrestricted environments and while several unlearning frameworks partially mitigate these attacks, very few are robust across all threat types.
Unlike previous works that fail to satisfy the tri-fold requirement of efficient unlearning, persistent erasure against adversarial prompts and preservation of generation quality, this paper bridges the gap
3

---

Spectral Eraser
Forgel
forget
Embedding
Space
Uyayyt
Apply Spectral Fraser
W₂
My Uy
(1
Paul
Hy
Tast Enccaler
(L-
Pail
U,
S- K-retes Vie forett Rr oxsesce
W.
E,-
U,
Concepts
Retain Embledding
Cruzedttamiion Layers in Diffition UNNr
Spance
PyP.
Figure 2: Overview of CURE. Given forget (F) and retain (R) sets, CURE constructs energy-scaled projectors (Py. P,) over their respective subspaces (Part 1), and derives a composite projection Pas to suppress erasable components while preserving shared content (Part 2). The action of py, P,,. and P, unit vectors yields directions aligned with the forget (red), retain (green), and shared (blue) subspaces. This operator is applied to cross-attention (Part 3), enabling lightweight unlearning.
by introducing CURE, a single-step, training-free weight update framework that applies a closed-form Spectral Eraser to isolate and remove undesired knowledge from diffusion models using tunable unlearning strength to guarantee robust, interpretable and efficient removal of any target concept(s).
Method
We present CURE, a training-free approach to concept removal in pretrained diffusion models that operates by constructing tunable geometry-aware projections using the proposed Spectral Eraser to precisely erase concepts by editing the model's weight matrices. We begin by reviewing core components of these models and their cross-attention mechanism, which underpin our method.
3.1 Preliminaries
Diffusion models have emerged the preferred choice of modern T2I applications due to their ability to synthesize figh-fidelity images via progressive denoising (63) using a U-Net backbone (64). To
improve scalability, many T2I systems employ latent diffusion 3 operating in the low-dimensional
latent space encoded by a pre-trained Variational Autoencoder (65) Text conditioning for the genera- tion process introduced through language models such as CLIP (66), whose token embeddings are injected into the U-Net through cross-attention layers. Specifically, these modules follow a standard Query-Kep Key-Value Value (QKV) formulation (67) modulate visual features with text guidance. For each token embedding ε, the attention mechanism generates keys and values via linear projections:
Concept Unlearning via Orthogonal Representation Editing
Problem Setup To formally characterize the concept erasure task, we begin by defining theoretic framework over the semantic space of prompts. Let U denote the universal set of concepts representable by the model's text encoder. Within U, identify subset F Z that contains concepts we intend to forget ey c.g., harmful content, undesired styles, etc. Conversely, we define retain C U containing concepts we wish preserve c,, such as general ceneral-purpose prompts or neutral categories. Concepts within F and R are often not disjoint. For instance, a concept like 'nude anime' may lie at the intersection of 'anime" (retained) and 'nudity" (forgotten) (i.e F R A 0). This formulation is key to preserving model performance on untargeted content when erasing concepts.
Constructing Discriminative Subspaces We embed the forget and retain sets, F and R, into Euclidean space via the model's 's frozen text encoder. Specifically, for each concept in F. or R, we derive target embeddings from their prompt tokens, denoted by E, and E respectively. To analyze their spectral directions of significant representation, characterized by the orthonormal basis vectors 24 for each embedding, we apply singular value decomposition (SVD) on these matrices obtain:
E, V E,
U.
(I)

---

Our forget and retain subspaces can hence be formally represented as Sy span(((y) and SR = span(U,,) respectively - geometrically representing directions subspace along which information about the respective concept is most strongly encoded.
To project any emhedding vector & E Rd onto these subspaces, naive approach simply defining projection operators for these subspaces would look like P, = UzU2 and P, = U, Unfortunately, as we elaborate next, P/ and P. isotropically weigh all singular directions and do not account for the varying significance of each basis vector for importance scaling. This implies that each spectral direction in a subspace is treated equally, disregarding relative spectral energy (E and Σ,) that distinguishes critical concept directions from incidental correlations. However, in practice, certain directions - corresponding to larger singular values - encode more salient or dominant aspects of concept than others. To account for this imbalance, we propose modified projection operators to incorporate an energy scaling mechanism that re-weights basis vectors based on their relative significance for precise and discriminative erasure, Specifically, we calculate the covariance structure of either embedding as 09. = u- where > is diagonal matrix with squared singular values, encoding the energy of each component. This suggests a natural projection operator that reflects the importance of each mode by scaling vector directions according to their spectral magnitude as:
Py = Uf P. = U,
Spectral Expansion Mechanism The described scaling function suffers from a challenge - although the diagonal structure of covariance naturally reveals the energy distribution across components (via of), it rigidly couples subspace direction selection to the intrinsic energy hierarchy. This implies that this inflexible spectral energy reweighting scheme limits controlling erasure strength in concept unlearning interventions. To address this, we introduce the Spectral Expansion mechanism an operator to curate the fraction of singular components selected for suppression. Formally, the Spectral Expansion operator, inspired by the Tikhonov regularizer (41), introduces a tunable parameter a that modulates relative spectral energy scaling. Specifically, we define the spectral expansion function as:
07%
f(raa) = (a 1)r; +1'
where Σj
where r; denotes the normalized spectral energy for the i-th singular component. The parameter a controls the tradeoff between mveryy-rooportonna weighting at a 1 (collapsing to the previous scaling function) and dominant-mode amplification at a + co (approximating a hard selection of all non-zero modes equally). Intuitively, as increases, the function f(r; a) becomes less sensitive to the relative magnitudes of ri. gradually saturating all nonzero components toward equal importance. This effectively flattens the spectral weighting curve, allowing more singular directions - including weaker modes- - to contribute equally and increases erasure strength by allowing the less discriminative vectors be to be more aggressively suppressed alongside dominant ones. As result, higher a values yield broader, less selective projection operators that remove a larger fraction of the concept subspace, making the intervention more comprehensive at the cost of finer-grained control. More details in Appendix. Consequently, we construct the spectral alignment operators as:
Py = UUUU, P, U,A,U,,
where A = diag( and A, diag daa
Closed-Form Spectral Erasing Given the strength-tuned projection operators Py and Pr. now construct a composite unlearning update that removes subspace contributions aligned with the forget set, with minimal influence on surrounding concepts by restoring overlap with the retain set:
Punleam := I Pais: where Pais = p P,P,
(5)
which acts on embeddings & to yield their updated version Eoew = Punleam * *E. This closed-form solution ensures that we remove only the discriminative directions of F while preserving components shared with R a necessary constraint to prevent performance degradation during concept erasure.
Absorbing the Unlearning Operator into Weight Space Rather than applying Punleam dynamically during inference on a per-token basis, we embed this operator into the model's stationary parameters by precomposing it directly onto the cross-attention weights. Given key and value projections are calculated as A = W&E and u = W.E, we translate the unlearning update to the weight matrices as:
W = Wi.Pnnlemm wwnw = W.P
(6)
so that any input embedding E is automatically projected into the targeted unlearned space during cross-attention k- computation, eliminating the need for runtime embedding projection overhead and enabling efficient, single-step concept removal during inference, as shown in Fig. 2
5

---

Bemoving Btyles
Remone Vax Sogh
Renove Vat Soyt
Defanding againat Unaade Content
Remove Nudiy
Wudty
S014
RBCK
CA
UCE
SL.
SAFREE
CURE (Own)
Figure 3: Comparison of unlearning methods on removing target artist styles and NSFW content. CURE more effectively suppresses the intended concept (blue arrows). * masks any unsafe outputs.
Experiments
In this section, we present the results of our method for erasing artistic styles, objects. identities, inappropriate concepts as well as resistance to red-teaming attacks, as illustrated in Fig. We use StablcDiffusion-v.. (SD-v1.4) (3) as primary T2I backbone, following recent work (34) (35),
and set a for all experiments expect NSFW concepts, where a is set to 5 for stronger crasure.
Artist erasure To evaluate the efficacy of style unlearning for mitigating artistic imitation and potential copyright violations, we follow prior works (34 use 20 prompts each for five classical artists (Van Gogh, Pablo Picasso, Rembrandt, Andy Warhol, and Caravaggio) and five modern artists (Kelly McKernan, Thomas Kinkade, Tyler Edlin, Kilian Eng, and the series Ajin: DemiHuman), all previously reported to be mimicked by SD (12). We apply CURE and all baselines to remove two styles: Van Gogh and Kelly McKernan. Evaluation uses LPIPS scores (68), reporting LPIPS, (on erased artists) and LPIPS, (on unerased artists), where higher LPIPS, indicates stronger removal of the target style, and a lower LPIPS, reflects better preservation of unrelated artists. Following (23), additionally use GPT-4o to classify artistic styles of the generated images. Acc, shows how often the unlearned style is still predicted lower better. Acc, measures accuracy on non-erased styles higher is better. As seen in Tab. D and Fig. a)). CURE achieves effective target erasure with minimal impact on unintended styles as well as impressive specificity in preserving normal content of COCO-30k (69), outperforming baselines. Further, CURE successfully thwarts black-box adversarial prompts crafted to trigger the 'Van Gogh' style, as shown in Fig 4b). demonstrating strong robustness against red-teaming attacks (37) when others fail resist. Finally, evaluate our method's scalability by erasing up to 1000 artist styles, while preserving all other styles. Fig. shows that after 50 erasures, outputs for the same prompt and seed start differ, as measured by LPIPS. but CLIP scores remain stable - highlighting that the retention component of our proposed update maintains overall alignment despite perceptual changes. More results in the Appendix.
Remove "Van Gogh"
Remove "Kelly McKernan"
COCO-30k
Method
LPIPS, 1
LPIPS,
Acc, 1
Acc,
LPIPS,
LPIPS,
Acc.
Acc, f
FID J
CLIP
SD-yL4
0.95
0.95
0.80
0.83
SLD-Medium 16
0.31
0.95
0.47
0.50
2.60
30.95
SAFREE 25
0.42
0.31
0.35
0.40
0.39
0.40
0.78
4.05
28.71
CA (29
0,30
0.13
0.65
0.90
0.22
0.17
0.50
0.76
7.87
31.16
ESD 27
0.40
0.26
1.0
0.89
0.37
0.21
0.81
0.69
3.73
30.45
RECE 35
0,31
0.08
0.80
0.93
0.29
0.04
0.55
0.76
2.82
30.95
UCE 14
0.25
0.05
0.95
0.98
0.25
0.03
0.80
0.81
1.81
23.08
CURE (Ours)
0.44
0.08
0.30
0.94
0.41
0.09
0.35
0.94
1.44
31.18
Table 1: (Leftt) Comparison on the Artist Concept Removal tasks using Famous and Modern artists. (Right) FID AND CLIP--ccrres against SD-v114. Best results holded and second best underlined. We gray out training-based methods for a fair comparison. Methods in pink apply run-time filtering only, and are considered guard railing techniques instead of unlearning techniques.

---

Emeing Kindaaee
Erasing Killan kin
Emsiig Kely McKeman
Brasing Vioeus Kindade
Frasing Frg
Brasing Kaily McKamaan
Erwing Kinlade
Brasing Kilien Eng
Eaaiigg Killy McKersze
Coaditionns
Ressppe NL. Caccape
CURE (Ours)
(b)
SDL44
CA
UCE
RECE
CURE (Ours)
Remove
Van Gogh
Prompt:
entreaplenysl courler dracing arthistory gogh couldn ance stars woold vrpaintings unbelievebly abous starry lives usserly T??.. vangagh motipreriously lovers. appropttrefarenne mmonnlgght gire Seaturing gogh reloaded theme
Figure 4: (a) CURE achieves stronger erasure with lower unwanted interference than baselines. Images with red borders are the target erasure, while off- off-diagonal images show impact on untargeted styles. (b) Evaluation against adversarial prompts discovered using the Ring-A-Bell method. Our method effectively eliminates Van Gogh's 's style, unlike baselines that remain vulnerable leakage.
Unsafe Content erasure We assess the effectiveness of crasing unsafe concepts on the I2P dataset (I6) containing 4, 703 real-world prompts across inappropriate categories such violence, self-harm, sexual content, and shocking imagery. We focus on nudity removal, and retain no additional concepts, generating
image per prompt and detecting nude regions using NudeNet (70) at 0.6 threshold. As shown Tab CURE yields the lowest number of nude body parts, outperforming all baselines. While methods like (27 29) also reduce nudity, they incur overheads from fine-tuning all U-Net weights and still exhibit poor FID scores. In contrast, CURE edits only 2.23% of the model and maintains high visual quality, in open-source settings, CURE offers a secure, model-integran
in Tab. T Compared [16] 23). which be bypassed
solution. Qualitative examples in 3ig draw similar conclusion. To demonstrate the robustness of our method in safeguarding against various attack methods, we further employ different red-teaming tools. including white-box methods such as (38 36), and black-box methods like (37: 62). CURE consistently achieves significantly lower suttcc-success--ee rate (ASR) than all training- frieeng-frree baselines across all attack types. Although (31) achieves decent performance, they rely on finetuning achieve this result, in contrast to our approach, which is completely trainingffnettning-free that uses controllable orthogonal updates to effectively erase the toxic subspace. We include more results on samples generated from our method on jail-breaking adversarial prompts in the Appendix.
This is attributed to our efficient closed-form operator
Object erasure To demonstrate the capability of our method erase objects from the diffusion model's 's learned concepts, with potential applications for removing harmful symbols and content, we investigate erasing Imagenette classes (7I), subset of Imagenet classes (72). Each target object (c.g.. 'French Horn') ') is treated as a forget concept Cy, without any additional retain concepts cr. To measure
Method
Breast(F)
Genitalia(F)
Breast(M)
Genitalia(M)
Buttocks
Feet
Belly
Armpits
Total
SD v1.4
183
44
42
129
SD v2.1
121
40
14
39
109
146
485
SLD-Med 16
72
34
6
5
19
24
166
SAFREE (23
132
11
12
121
400
ESD-u 27
5
SA (28
39
4
10
32
49
15
163
CA 22
14
23
70
LCE B4
31
126
RECE 35
0
23
17
66
CURE (ours)
0
5
2
11
Table 2: Performance comparison for inappropriate content removal on the I2P dataset. Number of nude body parts generated is detected using NudeNet, with threshold set to 6. Female; M: Male.
7

---

(ASR)
Method
Weights Modification
Training-Pes Free
I2P [16]
IND (36
Ring-A-Bell 37
MMAADiffusin [
UntsuraDifAAtk [$]
St.D-Mrdium
1B
0.142
0.934
0.660
0.942
0.648
SLD-SSunng
0.620
0.200
SLD Max
10
X
0.115
0,502
0,570
0.537
0.479
SAFREE
0.584
0.585
ESD
27
0.140
0.750
0.525
0.573
0.761
SA
0.062
0.623
0.239
0.205
0.268
CA 25
0.078
11639
0.376
0.555
0.856
MACE
0,023
0.142
0.076
0.183
0.176
SDID
0.645
0.907
UCE 239
0.100
0.667
0.331
0.367
0.430
355
0.064
0.134
0.675
0.655
CURE (Ours)
0.061
0.107
0.013
0.169
0.281
Table 3: Robustness of all methods against red-teaming tools, measured by Attack Success Rate (%)
the effect of erasure on both the targeted and untargeted classes, we generate 500 images per class and evaluate top-1 accuracy using a pretrained ResNet-50 classifier (73 Tab. displays quantitative results comparing classification accuracy when generating the crased class and remaining nine classes, using unlcarned models from our method and previous baselines. including SD-v1.4 with negative prompts (NP) (74). Notably, without explicit preservation, our approach exhibits superior crasure capability while minimizing interference on non-targeted content. Additional results are shown in the Appendix. To assess unlearning robustness across methods, we present an example of protecting against an adversarial prompt in Fig- that targeted generating the concept 'car' in models that have forgotten this concept. Amongst all methods, only CURE avoids generating the erased object. For assessing generality of erasure, we evaluate each unlearned model by prompting with concept synonyms. As seen in Fig. 5 our method resists generation of images reflecting the removed concept and synonymous forms, while effectively maintaining any unrelated concepts.
Identity erasure In this section, we evaluate unlearning methods with respect to their ability to erase celebrity identities. The efficacy of each erasure method tested by generating images of the celebrities intended for crasure, and successful erasure can be measured by a low top-1 GIPHY Celebrity Detector accuracy (75) in correctly identifying the erased celebrities. phenomenon is investigated in Fig. 5 which showcases the efficacy of our unlearning operator. In this comparison, John Wayne is the erasure group, with no additional concepts the retention group. Notably, the preservation of John Lennon's image poses challenge due to his shared first name, 'John', with John Wayne in the erasure group. Our method demonstrates impressive unlearning specificity by effectively overcoming this issue. Additional results in the Appendix.
interesting
Removing Objects
Pronge Larpia
Remove airglans
Promp A
sirplane
Promue Astccuubl
Remove airylans
Removing Identities
Remove Johre Wayne
Pronge ais
Proee A oii Lesuunss
Remove Jehn Wayne
SD1.4
CA
UCE
SLD-M
ESD
MACE
CURE
Figure 5: CURE removes object and identity concepts, unlearning both direct and synonymous forms (top), while preserving unrelated concepts that may share common words with the target (bottom).

---

Accuracy
Accuracy Other
ESD-u
UCB 51
RECE [5
SD-NP
Ours
SD
ESD-u (2
UCE 31
RECE
SD-NP
Ours
Cassette Player
15.6
0.65
01.0
0.0
4,6
0.0
85.1
64.5
90.3
90.3
64.1
90.4
Chain Saw
0.0
0.0
25.2
79.6
68.2
76.1
76.1
50.9
76.0
Church
8.4
2.0
21.2
78.7
71.6
English Spriager
92.5
0.2
0.0
0.0
0.0
76.6
62.6
78.9
77.8
63.6
78.6
French Hom
9996
0.0
0.8
8.0
0.0
75.8
49,4
77.0
77.0
58.0
79.2
Carhage Trick
14.8
6.2
77.4
50.4
75.7
Gas Pump
75.4
0.0
0.0
10.8
78.5
66.5
80.7
30.7
54.6
79.6
Goll Ball
97
5.8
0.8
0.0
45.6
0.6
76.1
65.6
79.0
79.0
55.0
80.3
Purachute
23.8
1.4
0.9
16.6
0.8
76.0
65.4
77.1
57.8
78.1
78.2
77.5
Average
78.2
12.6
2.6
0.3
19.4
La
78.2
63.2
79.8
78.5
56.9
29.6
Table 4: Comparison accuracy of erased and unerased object classes acToss different methods.
0.27
Method
Med. Time (s)
Inference Time (shumple))
Model Mod. (%)
ESD Hb
4500
7,08
94.65
CLP Soure
10
0.25
484
UCB
7.08
225
16
0.23
RBCE
85
+
7.12
223
15
0.21
50 100
500 1000
CURE (mang)
2
7.06
2:25
Artiats Brased Dog scale)
Figure 6: Our method can erase upto 100 artists while performing similar to original SD. Beyond that, erasing more styles has interference effects on untargeted artworks.
Table 5: Frasure efficiency comparison when re- moving the "nudity" concept. Evaluated A40 GPU for 100 iterations.
SD14
ESD
UCE
RECE
SD-NP
CURE (Ours)
Remove
theleso
ettrchotypes slan inquertad susrstasnngellers tra Socus
Figure 7: Generated samples from an adversarial prompt created using Ring-A-Ben A-Bell for the concept 'car' on all unlearnt models, visualizing the defense robustness of our technique compared to baselines.
Unlearning Efficiency We compare the overheads of concept erasure methods, including training- based approaches 27 22) that rely on online optimization, training-fres free methods (34 35) that apply
closed-fome edits to attention weights and (16) (33 that are runtime filtering-bast based, requiring no pre-pre pre-preemptive modification to diffusion model weights. As shown Tab. [5] CURE strikes the best balance among all methods, combining low modification (mod.) time with fast inference.
5
Limitations
Our method incurs a one-time SVD cost for subspace construction, but this step is offline and has no impact on inference speed. Secondly, the spectral expansion parameter introduces additional degree of freedom, but we find provides interpretable user control over forgetting strength and can be tuned without retraining. Finally, while highly adversarial prompts may still trigger partial leakage, CURE significantly reduces vulnerability and lays foundation for stronger defenses when combined with any existing safeguarding technique for enhanced robustness. However, while CURE promotes ethical generative modeling, it could be misused to erase forensic watermarks or provenance signals. Possible mitigation includes provenance-preservinng mechanisms gated model release protocols.
6 Conclusion
We present CURE, a training-free, closed-form framework for fast, reliable concept unlearning in T2I diffusion models. By constructing controllable spectral projection operators over discriminative subspaces and embedding the intervention directly into attention weights, CURE enables efficient, precise and scalable concept erasure with minimal model modification. Our approach effectively balances targeted erasure, generation quality preservation, and runtime efficiency, outperforming baselines across a range of benchmarks. Moreover, CURE demonstrates strong robustness against both white-box and black-box red-teaming attacks without requiring retraining or inference-time filtering. We believe CURE provides a principled and practical foundation for responsible deployment of generative models, thereby fostering the development of safer Al community.

---

7 Potential Impact Statement
CURE can erase any concept that admits a sufficiently precise textual representation in the model's embedding space. This dependency makes arbitrary removal of unknown backdoors or watermarks non-trivial: an adversary must already know what they intend to target and able to specify textually. However, as with other editing tools, misuse risks exist. We explicitly caution against unvetted use in high-stakes domains and recommend governance aligned with model-release policies. To this end, we outline safeguards that practitioners can layer atop CURE: (i) Prompt filtering to prevent unlearning of protected tokens or safety-critical concepts; (ii) Gated execution in deployment, where CURE is sandboxed and permitted only for whitelisted set of concepts; (iii) Auditability via logging of edits and publishing of the exact projection operator thereof for reproducibility and oversight. These controls complement CURE's inherent transparency and support accountable editing workflows.
8 Acknowledgment
This work was supported in part by the Center for the Co-Design of Cognitive Systems (CoCoS research center under the Joint University Microelectronics Program (JUMP) 2.0, Semiconductor Research Corporation (SRC) initiative sponsored by DARPA; and by the U.S. Department of Energy (DOE) Office of Science, Office of Basic Energy Sciences, and by National Science Foundation.
References
[1] J. Song, C. Meng, and S. Ermon, "Denoising diffusion implicit models," arXiv preprint arXiv:2010.02500, 2020.
[2] A. Nichol, P. Dhariwal, A. Ramesh, P. Shyam. P. Mishkin, B. McGrew, I. Sutskever, and M. Chen, "Glide: Towards photorealistic image generation and editing with text-guided diffusion models," arXiv preprint arXiv:21 2021.
[3] R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, "High-resolution image synthesis with latent diffusion models," in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 10684-10695, 2022.
[4] A. Ramesh, P. Dhariwal, A. Nichol, Chu, and Chen, "Hierarchical text-conditional image generation with clip latents," arXiv preprint arXiv:2204.06122 vol. 1, no. 2, p. 3, 2022.
[5] C. Saharia, W. Chan, S. Saxena, L. Li, J. Whang, L. Denton, K. Ghasemipour, R. Gontijo Lopes, B. Karagol Ayan, T. Salimans, et al., "Photorcalistic text-to-image diffusion models with deep language understanding," Advances in neural information processing systems, vol. 35, pp. 36479-36494, 2022.
[6] L. Yang. Z. Zhang, Y. Song, S. Hong, R. Xu, Y. Zhao, W. Zhang, B. Cui, and M.-H. Yang, "Diffusion models: A comprehensive survey of methods and applications," ACM Computing Surveys, vol. 56, no. pp. 1-39, 2023.
[7] C. Schuhmann, Beaumont, R. Vencu, C. Gordon, R. Wightman, M. Cherti, T. Coombes, A. Katta, C. Mullis, M. Wortsman, al., "Laion-5b: An open large-scale dataset for training next generation image-text models," Advances in neural information processing systems, vol. 35, pp. 25278 25294, 2022.
[8] N. Carlini, C. Liu, U. Frlingsson, J. Kos, and D. Song, "The secret sharer: Evaluating and testing unintended memorization in neural networks." in 28th USENIX security symposium (USENIX security 19), pp. 267-284, 2019.
[9] S. Andersen, K. McKernan, and K. Ortiz, "Andersen et al. stability ai Itd. et al., case no. 3:2023ev00201." httpp://wwet courtlistener cww com//bocket/66722122
wttorrrennn-sstaait-----eee U.S. District Court for Northern District of California, filed January 2023.
2023.
[10] H. H. Jiang, L. Brown, J. Cheng, M. Khan, A. Gupta, Workman, A. Hanna, J. Flowers, and T. Gebru, "Ai art and its impact on artists," in Proceedings of the 2023 AAAI/ACM Conference on AI, Ethics, and Society, pp. 363-374, 2023.
[11] K. Roose, "An a.. generated picture won an art prize. artists aren't 't happy.." https: https://wwx http:///wwttttttt/ee nymimes 00022/09/02/tcchr///
arttfficaaatiiiiaall... intelligence artists html Sept. 2022, The New York Times, accessed April.
10

---

[12] S. Handderr, "Ai art generators hit with copyright suit over artists' htse/sss http:://///ww....ooobr.......... com/ip-lav/ai-an wawll///aa-rrt wtt.a////aaaa---geertrrr-rre www.ioorr--iiiiii--ooooooe wtthh-ooppggggttuutttee wwtteerr-rttttt-eee -itgesss 2023. Bloomberg Law, accessed April 16, 2025.
Jan.
[13] Y. Mirsky and W. Lee, "The creation and detection of deepfakes: A survey" ACM computing surveys (CSUR), vol. 54, no. 1. pp. 1-41, 2021.
[14] L. Verdoliva, "Media forensics and deepfakes: an overview." IEEE journal of selected topics in signal processing, vol. 14, no. 5. pp. 910-932, 2020.
[15] T. Lorenz, "Ai-generated porn and deepfakes raise fears of digital abuse." atttps//wwk /www washingtonpost. ctw/ tww.nolohhocoycooooooooooooy http///222///////// 1ttp///////////// pornn-deppakes- women- consent/ 2023. The Washington Post, accessed April 16, 2025.
Feb.
[16] P. Schramowski, M. Brack, B. Deiseroth, and K. Kersting, "Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models." in Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 22522-22531, 2023.
[17] Stability AL "Stable diffusion
release." -iffleddiffsoon v2- release Nov. 2022. Accessed April 16, 2025.
https//stabllity.a/nnnex
[18] Lopez and AI. "Stable diffusion 2.0 release." "
ve-eiiioo----eeee release Nov. 2022. Accessed: 2025-05-02.
[19] N. Carlini, M. Jagielski, C. Zhang, N. Papernot. A. Terzis, and F. Tramer, "The privacy onion effect: Memorization is relative," Advances in Neural Information Processing Systems, vol. 35, pp. 13263-13276. 2022.
[20] L. Dixon, J. Sorensen, N. Thain, and L. Vasserman, "Measuring and mitigating unintended bias in text classification," in Proceedings of the 2018 AAAI/ACM Conference on AI, Ethics, and Society, pp. 67-73, 2018.
[21] AssemblyAI, "Stable diffuusio vs 2: What you need to know." httph:tt///// http:://wwaaasssmme www.emblyaa.ccmmmml.o....... lonbll-ddffuuiion---11 w-attaa-------a- what -aaaatt--ooo you- need- to tokow Dec. 2022. Accessed April 16, 2025.
[22] J. Rando, D. Paleka, D. Lindner, L. Heim, and F. Tramèr, "Red-teaming the stable diffusion safety filter." arXiv preprint arXiv:2210.046/1 2022.
[23] J. Yoon, S. Yu, V. Patil, Н. Yao, and M. Bansal, "Safree: Training- free and adaptive guard for safe text-to-image and video generation," arXiv preprint arXiv:2410.1276. 2024.
[24] W'AuooaticRessarrcher, "Tutorial: How to remove the safety filter in 5 seconds." https how ses_tt__reee remove the
7/иUw. www.it.dddi... wttpa//e/tttaabfffeueeeeeeeeeeee http://wbw....eeooooooooooo/t///
safety_ filter_ in_5/ 2022. Accessed: 2025-04-16.
[25] Y. Deng and H. Chen, "Divide cnd-uuqueer attack: Harnessing the power of Ilm bypass the censorship of texl-lo-image generation model," CoRR, 2023.
[26] Y. Wu, Zhou, M. Yang, L. Wang. H. Chang. W. Zhu, X. Hu, X. Zhou. Yang, "Unlearning concepts in diffuusion model via concept domain correction and concept preserving gradient," in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 39, pp.
2025.
[27] R. Gandikota, J. Materzynska, J. in Proceedings of the IEEF/CVF International Conference on Computer Vision, pp. 2426-2436, 2023.
and D. Bau, "Erasing concepts from diffusion models,"
[28] A. Heng and H. Soh. "Selective amnesia: A continual learning approach to forgetting in deep generative models." Advances in Neural Information Processing Systems, vol. 36. pp. 17170-17194, 2023.
[29] N. Kumari, B. Zhang, S.-Y. Wang. E. Shechtman, R. Zhang, and J.-Y. Zhu, "Ablating concepts in text-to- image diffusion models." Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 1227022,,, 2023.
[30] X. Li, Yang, Deng, C. Yan, Y. Chen, X. Ji, and Xu, "Safegen: Mitigating unsafe content generation in text-to-image models." arXiv e-prints, pp. arXiv-2404, 2024.
[31] S. Lu, Z. Wang. L. Li, Y. Liu, and A. W.-K. Kong, "Mace: Mass concept erasure in diffusion models." in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 6430-6440 6440, 2024.
11

---

[32] H. Orgad, B. Kawar, and Y. Belinkov. "Editing implicit assumptions in text-to-image diffusion models," in Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 7053-7061, 2023. 2023.
[33] T. Xiong. Y. Wu, E. Xie, Z. Li, and X. Liu, "Editing massive concepts in text-to-image diffusion models," arXiv preprint (iii::2033138077 2024.
[34] R. Gandikota, H. Orgad, Y. Belinkov, Materzyńiska, and D. Bau, "Unified concept editing in diffusion models," Proceedings the IEEE/CVF Winter Conference on Applications of Computer Vision, pp. 5111- 5120, 2024.
[35] C. Gong, K. Chen, Z. Wei, J. Chen, and Y.-G. Jiang, "Reliable and efficient concept erasure of text-to-image diffusion models," in European Conference on Computer Vision, pp. 73-88. Springer. 2024.
[36] Z.-Y. Chin, C.-M. Jiang, C.-C. Huang, P.-.. Chen, and W.-C. Chiu, "Prompiing&debugging Red-teaming text-to-image diffusion models by finding problematic prompts." arXiv preprint arXiv:3309.06/35 2023.
[37] Y.L.. Tsai, C.-Y. Hsu, C. Xie, C.-H. Lin, J.-Y. Chen, B. Li, P.-Y. Chen, C.-M. Yu, and C.-Y. Huang. "Ring- a-bell! how reliable concept removal methods for diffusion models?," arXiv preprint arXiv:2310.1000 2023.
[38] Y. Zhang, J. Jia, X. Chen, A. Chen, Y. Zhang, Liu, K. Ding, and Liu, "To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now," in European Conference on Computer Vision, pp. 385-403, Springer, 2024,
[39] M. E. Wall, A. Rechtsteiner, and L. M. Rocha, "Singular value decomposition and principal component analysis," in A practical approach to microarray data analysis, pp. 91-109, Springer, 2003.
[40] K. Baker, "Singular value decomposition tutorial," The Ohio State University, vol. 24, p. 22, 2005.
[41] P. C. Hansen, "Regularization tools: A matlab package for analysis and solution of discrete ill ill-posed problems," Numerical algorithmss, vol. 6, no. pp. 1-35, 1994.
[42] P. C. Hansen, Rank-deficient and discrete ill-posed problems: numerical aspects of linear inversion. SIAM, 1998.
[43] Freeman, "Lecture 7: Regularization and prior knowledge." lattps://www mit 9..uu/99.5200))
scribe scribe-notes/cee cl7, .dff 2006. MIT Course 9.520 Statistical Learning Theory and Applications.
[44] Y. Cai, S. Yin, Y. Wei, C. Xu, W. Mao, F. Juefei-Xu, S. Chen, and Y. Wang. "Ethical-lens: Curbing malicious usages of open-source text-to-image models," Putterns, vol. 6, no. 3, 2025.
[45] M. Lyu, Y. Yang, H. Hong, H. Chen, X. Jin, Y. He, H. Xue, J. Han, and G. Ding, "One-dimensional adapter to rule them all: Concepts diffuuson models and erasing applications." in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 7559-7568, 2024.
[46] M. Pham, K. O. Marshall, C. Hegde, and N. Cohen, "Robust concept erasure using task vectors," arXiv preprint a Xiv:2404.036311, 2024.
[47] C. Fan, Liu, Y. Zhang, F. Wong, D. Wei, and S. Liu, "Salun: Empowering machine unleam- ing via gradient-based weight saliency in both image classification and generation," arXiv preprint arXiv:2310. 12508, 2023.
[48] C.-P. Huang, K.PP. Chang, C.-T. Tsai, Y.H.. Lai, F-E. Yang, and Y.-.. E. Wang, "Receler: Reliable concept erasing of text-to-iman diffusion models via lightweight erasers," in European Conference on Computer Vision, pp. 360-30 376, Springer, 2024.
[49] G. Zhang, K. Wang, X. Xu, Z. Wang, and H. Shi, "Forget-me-not: Learning to forget in text-to-image diffusion models," " Proceedings of IEEE/CVF conference on computer vision and pattern recognition, pp. 1755 1764, 2024.
[50] C. Kim, K. Min, and Y. Yang, "Race: Robust adversarial concept erasure for secure text-to-image diffusion model," in European Conference on Computer Vision, pp. 461-478, Springer, 2024.
[51] Y. Park, S. Yun, J. Kim, J. Kim, G. Jang, Y. Jeong, J. Jo, and G. Lee, "Direct unlearning optimization for robust and safe text-to-image models," arXiv preprint arXiv:2407.21033 2024.
[52] A. Das, V. Duddu, R. Zhang, and N. Asokan, "Espresso: Robust concept filtering in text-to-image to-image models." arXiv preprint arXiv:2404.192.. 2022,
12

---

[53] H. Li. C. Shen, P. Torr, V. Tresp, and J. Gu, "Self-discovering interpretable diffusion latent directions for responsible text-to-image generation." " in Proceedings the IEEE/CVF Conference Computer Vision and Pattern Recognition. pp. 12006-12016, 2024.
[54] R. Liu, A. Khakzar, Gu. Q. Chen, P. Torr, and Pizzati, "Latent guard: a safety framework for text-to-image generation," in European Conference on Computer Vision, pp. 93-109, Springer, 2024.
[55] H. Zhang, Y. He, and H. Chen, "Stecrdiff: Steering towards safe text-to-image diffusion models," arXiv preprint arXiv:2410.02710, 2024.
[56] S. Kodge, D. Ravikumar, G. Saha, and K. Roy, "Sap: Corrective machine unlearning with scaled activation projection for label noise robustness." in Proceedings of the AAAI Conference on Artificial Intelligence. vol. 39, pp. 17930- 17900, 2025.
[57] G. Saha, I. Garg, and K. Roy, "Gradient projection memory for continual learning," arXiv preprint 2xXiv:2103.09722 2021.
[58] G. Li, K. Chen, Zhang. J. Zhang, and T. Zhang, "Art: Automatic red-tcaming for text-to-image models to protect benign users," arXiv preprint orXiv:2405. 19360, 2024.
[59] K. Chen, Z. Wei, Chen, Z. Wu, and Y.G.. Jiang, "Gema: Generative cross-modal transferable adversarial attacks from images to videos," in Proceedings of the 31st ACM International Conference on Multimedia, 2023.
pp.
[60] M. Kim, H. Lee, B. Gong, H. Zhang, and S. J. Hwang, "Automatic jailbreaking of the text-to-image generative ai systems," arXiv preprint arXiv:2405. /6567, 2024.
[61] M. Pham, K. O. Marshall, N. Cohen, G. Mittal, and C. Hegde, "Circumventing concept crasure methods for lext-to-image generative models," arXiv preprint arXiv:2388.01508 2023.
[62] Y. Yang, R. Gao, X. Wang, T.-Y. Ho, N. Xu, and Q. Xu, "Mma-diffusion: Multimodal attack on diffusion models," Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 7737-7746, 2024.
[63] J. Ho, A. Jain, and P. Abbeel, "Denoising diffusion probabilistic models," Advances in neural information processing systems, vol. 33, 6840 6851, 2020.
[64] O. Ronneberger, P. Fischer, and T. Brox, "U-net: Convolutional networks for biomedical image segmenta- tion," in Medical image computing and computer-assisted intervention-Mil -MCCAAI 2015: 18th international conference, Munich, Germany, October 5-9, 2015, proceedings, part III 18, pp. 234-241, Springer. 2015.
[65] C. Doersch, "Tutorial on variational autoencoders," " arXiv preprint wrxXvv:6666005000 2016.
[66] A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin. Clark, et al., "Learning transferable visual models from natural language supervision," in International conference on machine learning. pp. 8748-8763, PmLR, 2021.
[67] A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, and I. Polosukhin, AAttention is all you need," Advances in neural information processing systems, vol. 30, 2017.
[68] R. Zhang, P. Isola, A. A. Efros, F. Shechtman, and O. Wang, "The unreasonable effectiveness of deep features as perceptual metric," in Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 586-595, 2018.
[69] T.-Y. Lin, M. Maire, S. Belongie, Hays, Perona, D. Ramanan, P. Dollár, and C. L. Zitnick "Microsoft coco: Common objects in context," in Computer vision-ECCV Switzerland, September 6-12, 2014, proceedings, part v 13, pp. 740-755, Springer, 2014.
ECCV 2014: 13th Earopean conference, zurich,
[70] P. Bedapudi, "Nudenet: Neural nets for nudity classification, detection and selective censoring," " 2019.
[71] Howard and S. Gugger, "Fastai: a layered api for deep learning." " Information, vol. 11, no. 2, p. 108, 2020.
[72] J. Deng, W. Dong, R. Socher, L.-J. Li. K. Li, and L. Fei-Fei, "Imagenet: A large-scale hierarchical image database," in 2009 IEEE conference computer vision and pattern recognition, pp. 248 245-255, Ieee, 2009.
[73] K. He, X. Zhang. S. Ren, and J. Sun, "Deep residual learning for image recognition," in Proceedings of the IEEE conference computer vision and pattern recognition, pp. 770-778, 2016.
13

---

[74] Y. Ban. R. Wang. T. Zhou. M. Cheng, B. Gong, and C.-J. Hsieh, "Understanding the impact of negative prompts: When and how do they take effect??" in European Conference Computer Viston, pp. 190-206, Springer, 2024.
[75] GIPHY, "Giphy celebrity detector." http:://ghhhhh.oooocc///////aeee 2020. Ac- cessed: 2025-04-18.
[76] P. Schramowski, C. Tauchmann, and K. Kersting, "Can machines help answering question 16 in datasheets, and in turn reflecting inappropriate content?," Proceedings of the 2022 ACM conference on fairness, accountability, and transparency, pp. 1550-13611 2022.
14

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
The abstract and introduction clearly state the main contributions of CURE, including training-free concept unlearning via orthogonal spectral projection, closed-form model editing, and the introduction spectral expansion mechanism for controllable forgetting strength. These claims match the method and experimental results presented in the puper, which demonstrate efficient, robust concept removal with minimal collateral damage across artist styles, objects, identities, and unsafe content.
Justification:
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
The paper provides a dedicated "Limitations" section that acknowledges the offline SVD cost, the introduction of the spectral expansion hyperparameter a, and the risk of partial leakage under adversarial prompts. It also notes the potential misuse CURE for forensic watermark removal and proposes mitigation strategies. While experiments show strong robustness, the paper transparently states that complete immunity to adversarial attacks is not guaranteed, and suggests future work on forensic monitoring and safeguard mechanisms. Overall, limitations and assumptions are clearly and honestly discussed.
Justification:
3. Theory assumptions and proof's
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
Justification: The paper does not present formal theorems or proofs. While it provides mathematical formulations for projection operators and spectral regularization, these are algorithmic constructions rather than formal theoretical results requiring proofs.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification: The paper fully describes the experimental setups, including datasets, evalua- tion metrics, model backbone (Stable Diffusion v1.4), unlearning targets (artists, objects, identities, and unsafe concepts), and hyperparameters such as the spectral expansion pa- rameter a. Ablation studies, baseline comparisons, and evaluation protocols (e.g., LPIPS, CLIP scores, red-teaming attacks) are clearly reported. Sufficient methodological and experimental detail is provided to reproduce the main results independently.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, described in supplemental material?
Answer: [Yes]
Justification: The code is already attached to the supplementary material for access to reviewers at present, and the paper also provides detailed descriptions of the datasets used and evaluation protocols, allowing others to replicate the setup. The experimental methodology, unlearning targets, and hyperparameters are fully disclosed. Full open access to code and pretrained models, with reproduction instructions, is planned upon acceptance ensure faithful reproduction by the community.
6. Experimental setting/details
15

---

Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Question:
Answer: [Yes]
The paper specifies all key experimental details, including datasets, unlearning targets, evaluation protocols, and hyperparameters such as the spectral expansion parameter The Stable Diffusion v1.4 backbone is clearly stated. While training is not required in CURE, the paper provides sufficient setup descriptions for full understanding and reproduc- tion of the results.
Justification:
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification: Following all prior work in this domain and for diffusion model experiments in general, the paper reports mean performance metrics across different settings but does not include error hars or confidence intervals. Therefore, while results are disclosed and reproducible, we conservatively select [No] to align with checklist guidelines.
8. Experiments compute resources
Question: For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Answer: [Yes]
Justification: The paper specifies that experiments were conducted using NVIDIA A40 GPUs (having 48GB memory). As CURE is a training-free method, only inference and subspace construction require compute, with the one-time SVD step performed offline. The inference cost is comparable to standard diffusion model sampling, and the paper notes that additional training runs fine-tuning performed, limiting overall compute usage the experiments reported.
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics
Answer: [Yes]
The research adheres to the NeurIPS Code of Ethics. CURE is designed to enhance the safety and controllability of generative models by enabling the removal of harmful or undesired concepts. The paper acknowledges potential misuse risks, such as forensic watermark removal, and proposes mitigation strategies. No human subjects were involved, and all datasets used are publicly available and appropriately licensed. Privacy, consent, and data usage considerations are addressed in accordance with ethical standards.
Justification:
Broader impacts
Question: Does the paper discuss both potential positive socictal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: The paper discusses both positive and negative societal impacts. On the positive side, CURE promotes ethical and controllable generative modeling by enabling efficient, targeted forgetting of harmful undesired concepts without retraining, supporting safer deployment of diffusion models. On the negative side, the paper acknowledges that CURE could potentially be misused remove forensic watermarks or provenance signals. Mitigation strategies such as forensic detection mechanisms and gated model release protocols are suggested address these risks. Thus, the broader impacts are thoughtfully considered and mitigation pathways are outlined.
11. Safeguards
16

---

Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: Although CURE improves model safety by enabling concept unlearning, modifies existing diffusion models and does not itself release new high-risk dataser or standalone generative model. Therefore, specific deployment safeguards such as access controls, safety filters, usage guidelines were not implemented. Future work could explore integrating safeguard mechanisms if complete pretrained model with CURE applied is publicly released.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
The paper properly credits and cites all external assets used. The Stable Diffusion v1.4 model, datasets such as COCO-30k, I2P etc.. and baseline methods are clearly referenced, with appropriate citations to their original sources. All datasets and models used are publicly available under permissive licenses or fair use terms, and no proprietary or restricted- accesss assets were employed.
Justification:
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: The paper does not introduce new datasets, pretrained models, standalone codebases at submission time. modifies existing publicly available models for unlearning purposes. Documentation and structured release of code for inference-time unlearning are planned upon acceptance, following ethical guidelines and licensing requirements.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsourcing or research with human subjects. All experiments are conducted using publicly available datasets and pre-existing models without any direct interaction with human participants.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve research with human subjects or crowdsourcing, All experiments are conducted using publicly available datasets and models, and no participant data was collected. Therefore, IRB approval equivalent review is not applicable.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality of the research, declaration is not required.
Answer: [NA]
17

---

The core methodology and experimental design of the paper do not involve the use of large language models (LLMs) as an important, original, or non-standard component. L.Mss were not used for concept erasure design, model modification, or evaluation, and any minor writing assistance does not affect the scientific rigor or originality of the research.
Justification:
18

---

Appendix
This appendix provides additional technical and experimental details support the main paper. Sec- tion elaaborates on the spectral expansion mechanism and its connection to classical regularization methods, along with visualizations illustrating the role of the expansion parameter a in controlling subspace selectivity, and hence erasure strength. Section Dection[]pressse preseents extended experimental results, including generalization to broader inappropriate content cafegories, evaluations on effective unlearn- ing and interference unrelated concepts, red-teaming comparisons, and assessment on general image generation quality after unlearning. Next, Sec. Ciovvddes additional discussions for CURE and experimental choices. Finally, Sec. D lists the licenses associated with all datasets and models used this work.
A Details on the Spectral Expansion Mechanism
A.1 Spectral Expansion function extension of Tikhonov regularizer
Our spectral expansion operator ["ry ax) can be interpreted through the lens of classical regularization strategies in statistics and inverse problems.
Tikhonov (Ridge) Regularization: In inverse problems 433 Tikhonov regularization seeks to
stabilize ill-posed systems Ax = b by solving the minimization problem:
= arg min || - b1l + A||=/|1
where the regularization term A || penalizes large-norm solutions. The closed-form solution is:
x²' (ATA+ -
In the spectral domain, if A U.VT is the SVD of A, then the solution decomposes
0i of +
x² = V diag
which implics that each singular mode o; scaled by the spectral filter:
( of
+²+
The spectral filter attenuates components associated with small singular values while preserving those corresponding to large, informative directions. This ensures a balance between fitting the data and maintaining model stability.
We now draw a direct connection between this classical filter and our adaptive spectral expansion function used in concept erasure:
Relation to Spectral Erasure Expansion.
0T; f(raa) (a 1)r,
where r; = = is the normalized spectral energy for mode i.
To align with Tikhonov, we re-express its filter terms of ri:
ri Σj
=
of r; E,E, of +
Now set the regularization parameter À in Tikhonov as:
A x= - Σ oj. x=
giving:
9:
r; +
OT'; +
19

---

LPIPS,
LPIPS +
Acca +
Acc.
0,41
0.17
0,47
0.96
0.46
0.19
0.08
0.94
0.47
0.26
0.06
0.86
10
0.49
0.27
0.05
0.85
100
0.51
0.30
0.00
0.86
1000
0.58
0.31
0.00
0.85
0.65
0.34
0.00
0.52
Table 6: Ablation of spectral suppression a. Larger a drives stronger forgetting (low Acc,) but hurts unrelated concepts (higher LPIPS.. lower Acc,). A moderate value balances both.
which closely resembles [(r; a),, and can be expressed geometry-aware spectral weight- ing mechanism that emphasizes high-energy (important) components while suppressing noisy or ambiguous subspaces.
While not identical, the key difference is the reparameterized denominator. The term (a - 1)r; + in expansion function introduces sharper weighting effect, which increases the separation between important and unimportant components compared to Tikhonov.
A.2 Visualizing Impact of in Spectral Expansion
To understand how the spectral expansion parameter a controls the strength and selectivity of concept suppression, we visualize both the expansion function and its effect on projection operators derived from the forget embeddings for the prompt 'cassette player'.
ar: Figure 8 (a) shows the spectral expansion function f(r;a)) [a-1)r+1I where ry denotes the normalized spectral energy of each mode. As a increases, the function transitions from energy- proportional weighting (at a = 1) to nearly uniform weighting across nonzero modes, flattening the spectral emphasis and promoting broader subspace coverage and hence stronger erasure.
In Figure 8 (b), we visualize the heat map of the projection operator P, UT where Uy and the spectral energies are obtained via SVD of the forget prompt embeddings, and A, diag(f a)). At low weaker directions (low energy spectral components) are heavily suppressed, leading to low-rank projections focused on the highest-energy modes. As increases, weaker directions are progressively included, and P approaches an orthogonal projector over the full concept span. This tunable shift enables smooth control between selective erasure and comprehensive forgetting.
A.3 Effect of the Spectral Suppression Strength
We study how the scalar suppression strength in our Spectral Eraser controls the erase-retain trade-off. We run "cat" removal over 100-image set spanning [tiger, lion, cheetah, leopard, dog, rabbit, mouse, bird, cat, feline). Here, Erased concepts e (cat, feline) probe forgetting, while Unerased concepts u all others probe specificity. We report LPIPS (f better for | better for u) and GPT-4o classifier accuracy (1 better for e, better for u) as semantic erasure proxy.
As shown in Table 6 very large a enforces strong forgetting (Acc, R 0) but degrades unrelated content (higher LPIPS... lower Acc.). Conversely, very small preserves quality (low LPIPS., high Acc,,) but yields poor forgetting (high Acc.). A moderate setting, e.g., a-2, provides a good balance (low Acc., high Acc,,) with limited collateral damage, supporting our choice to interpretable control for forgetting strength. We adopt a ===2 as the default unless noted otherwise.
single,
B Detailed Experimental Details and Additional Results
B.1 Extended Inappropriate Content Removal
We also compare the models across broader categories of inappropriate content. the main text, specifically address erasing nudity to align our experiments with those in the original ESD
20

---

a= d=3 d.5
(8)
Figure 8: (a) The spectral expansion function f(rg a) transitions from singular-value energy- proportional weighting a = to near-uniform weighting as a > oc, flattening sensitivity across modes and enabling broader subspace suppression. (b) Visualization of projection operators P = U computed from the SVD of the forget prompt "cassette player'. For small a, only only selective subspaces are erased, leading to weaker erasure. As increases, additional modes are progressively included in the suppression, and Py converges toward an orthogonal projector over the full forget subspace, indicating comprehensive erasure.
paper (7), as nudity is a classical example of an inappropriate concept. Tab. 7 we further illustrate method's effectiveness in removing various sensitive concepts from the I2P dataset (16), including "hate, harassment, violence, suffering, humiliation, harm, suicide, sexual, nudity, bodily fluids, blood'. For this evaluation, set to 5 and retain additional concepts. To measure the proportion of inappropriate content across these different categories in I2P, we employ the fine-tuned Q16 classifier (76). which more accurately identifies general inappropriate classes. The results confirm that our approach successfully eliminates these sensitive concepts, outperforming all existing baselines.
Category SDv1.4
ESD-u (77
CA (29)
UCE 34
SLD-Med (16)
CURE (Ours)
Hate
21.2
3.5
15.6
10.8
41.1
7.4
Harassment
19.7
6.4
15.9
12.1
20.1
8.5
Violence
40.1
16.7
31.3
23.3
19.7
13.1
Self-harm
35.5
11.1
21.7
12.9
19.2
9.7
Sexual
54.5
16.4
32.7
16.2
22.9
7.6
Shocking
42.1
16.1
30.7
19.2
16.0
15.3
Illegal Activity
19.4
6.3
13.2
9.8
20.5
9.6
Overall
35.6
12.2
24.3
15.6
20.8
10.2
Table 7: Comparison of inappropriate proportions (%) for different removal methods. Bold: best.
Underline: second-best.
B.2 Additional Qualitative Results
In this section, we present additional qualitative results. Images in the same row are generated with same prompts and seeds.
Fig. shows images conditioned by adversarial prompts related to nudity from the P4D dataset (36) and Ring-A-Bell dataset (37). Our method effectively removes nudity information, where all other method fail to safeguard against NSFW outputs. This highlights the robustness our approach against red-teaming attacks.
Fig. 10 provides visual samples for further assessing the removal an artistic style, and evaluating the interference of different unlearning approaches on untargeted artistic styles. The images enclosed in dotted borders are intended erasure, and the off-diagonal images show effect on different styles. While SLD (16) fails to preserve the original composition in SDv1.4 1.4 (first column), marking obvious impact on general image generation capabilities of the unlearnt model, it also fails to show acceptable unlearning difference between the images marked for intended erasure and the untargeted images.
21

---

SAFREE
(Ours)
Remove
Nudity
Prompt: paulinn lewardeeassobennite dee stan Wisttiis tris zx. 22,1A finoatt cude sianfordar's nov
Remove
Nudity
compstenissterriie Outimucha sipples aproad copyrigholl)
Nudity
Promitt collcting VODuS musood
cuerstature ORSMOCIAn
geomAn dafletesyy contemplaingg pcsigtor carnepaintigg picsaoo
american Figurative
Figure 9: Qualitative comparisons of different approaches examples from the P4D dataset (36) and the Ring-A-Bell dataset (77) We manually masked unsafe generated results for display purposes.
Erasing Thamar
Brasing Xillan Eng
Brusing Xall McKomaan
Brasing Threas Kinfaai
Brsiing Kilan
Ereiing
Bassing Thrmss Kinbase
Erasing Xillan Eng
Ensing Kaly McXeman
Kaly McKemann
Kimdaae
Rodoud sugiod wocgiaa
Pronptt Conditioning
AApACA THarusi by
S
SDvL4
CURE (Ours)
UCE
SLD
Figure 10: CURE achieves stronger erasure with lower unwanted interference than baselines. Images with red borders are the target erasure, while off-diagonal images show impact on untargeted styles.
(Ours)
parked to Sront of Bond Lindd mntergyria
with biue and
vittt dtok aod
woraan iaerytn 60
Drnnge Young
opHord unbostaane
Figure 11: Qualitative results on the COCO-30K dataset visualizing impact on general image generation capabilities post-unlearning of the "nudity" concept.
UCE 34)
preserves image quality on the off-diagonal generations, but shows strong similarity to the
erased target images, which is undesirable. In comparison, our method exhibits high dissimilarity to the erasure target image, as well as high similarity to the unrelated images. Hence, our approach excels in both aspects of effective unlearning and minimal impact unintended concepts.
22

---

Removing Objects
Promept
photo
Remove oat
Phorpe ploto of
Prompe pireo of
Remove Gat
Removing Identities
Remove Ander Heard
Pronge sbach of
Thomps A of
Ander Heard
SDL4
CA
UCE
SLD-M
ESD
MACE
CURE (Ours)
Figure 12: The images on the same row are generated using the same random seed. (Top) Qualitative results for unlearning 'cat' show that our method effectively removes the concept and its synonym "feline," demonstrating strong generality of erasure in contrast to baselines that succumb to synony- mous forms. Additionally, this shows no impact on unrelated concepts that have not been targeted. (Bottom) Erasing celebrity demonstrates high specificity, preserving untargeted identities without requiring additional retention sets.
Fig. II shows images conditioned on COCO-30K captions. A good unlcarning method should produce well-aligned images for unerased concepts. Methods like SLD (16) struggles to generate the a young woman carrying an umbrella, as seen the third row.
Fig. 12 presents additional results for object and identity removal. In the top three rows, our method robustly erases the concept 'cat', including synonymous forms like 'feline', confirming strong generalization of unlearning, Crucially, unrelated content remains unaffected. In the bottom two rows, unlearning the identity 'Amber Heard' demonstrates high specificity targeted removal leaves other identities untouched, even without dedicated retain sets. These results underscore our method's capability to selectively remove targeted concepts while faithfully preserving unrelated content.
C Additional Discussions
Optional Retain Set. Let Py and P, denote the orthogonal projectors for the forget and retain subspaces, respectively, and let 0 be the spectral suppression strength. CURE supports optional retain set: when no retain supervision is provided, we set P, = 0 and the operator reduces to forget-only form that still performs targeted erasure via spectral shrinkage along discriminative directions of the target concept.
While P, offers fine-graines control knob when available, CURE remains effective without it: in our main evaluations (Tables !
we set P.. 0 and still observe strong crasure with minimal This design choice reflects realistic black-box deployments where "safe" concepts are under-specified and suppression is driven instead by the spectral parameter a, which concentrates attenuation along the most discriminative directions of the target subspace, implicitly preserving neighboring semantics. When desired, users may supply P, for added specificity (e.g.. artist erasure in Fig. [
2
3
degradation to unrelated content Figss
Scope Guarantees. CURE is grounded in spectral geometry and admits Tikhonov-style interpre- tation (Sec A). which clarifies how forgetting pressure is distributed across subspaces. However, we do claim formal guarantees on global optimality or worst-case trade-offs between the forget and retain subspaces. Establishing such guarantees e.g., bounds on leakage of erased concepts under
23

---

prompt perturbations while preserving retain fidelity - remains an important direction for future work.
Data/Model Dependence. Our projections depend on the quality of text embeddings provided to the diffusion model. While our experiments show strong robustness across objects, styles, identities, and Appendix Table 7 the framework inherits any systematic biases or brittleness from the underlying text encoder.
NSFW concepts (Main Manuscript Tables I 2 3
Setting the NudeNet Threshold. We evaluate NSFW detection using NudeNet with a decision threshold of 0.6. This choice follows recent practice in safety filtering (35), where this value has been adopted to better capture borderline NSFW content. This threshold ensures compatibility with unfeet--sensitvee applications by being sufficiently conservative. Importantly, for faimess and consisteney, all methods in our evaluation, including baselines, have been assessed using this same threshold.
Subspace construction and Prompt Templates. For each target concept, we construct an embedding basis using concise prompt templates that substitute the concept into common forms: "picture of/by [placeholder]" "photo of/by [placeholder]" "image of/by [placeholder]" "portrait of/by [placeholder]". This is consistent with prior works (34) 35). Empirically, we observe using 3-5 diverse prompts suffices to construct a stable and expressive embedding basis. For unsafe content erasure, we adopt the prompt "violence, nudity, harm", following established protocol in (34) for fair comparison.
Computational Overhead for CURE. In practice, SVD is performed only once offline over the token embeddings of concept prompts, which are short in length (typically tokens) and embedded into a 768-dimensional space. Thus, the actual SVD computation is extremely lightweight on the order of milliseconds on CPU and not a bottleneck. Once the forget/retain subspaces are computed, the weight projection is a one-time linear algebra operation, requiring under seconds on GPU for all layers. We further provide supporting details for this:
Token Embedding Extraction: For each concept to be forgotten (e.g., "cat"), we extract token embeddings using Stable Diffusion's 's text encoder. This typically results in small matrix of size Ntokens X 768. For example, the prompt "cat" yields 2 tokens, which can be expanded using related phrases like "a picture of [placeholder concept]" to around 6 tokens. This step is equivalent to a single text encoder forward pass and takes less than 0.1 seconds.
SVD Computation: We perform reduced SVD on the token matrix (e.g.. 6 X 768), retaining top-k components (typically I 5). This computation is lightweight and completes in under 0.5 seconds on single GPU using standard libraries like toreh.linal..vvd.
Projection Operator Construction: We construct the projection matrix Paie using spectral expansion with strength parameter (e.g., a 2). This matrix operation is inexpensive and completes in less than 0.1 seconds.
Cross-Attention Weight Update:
We apply the resulting operator the key and value weights in the cross-attention layers of Stable Diffusion's 's U-Net. Since the edit is closed-fome and affects a fixed number of layers, the update takes roughly 1.2 seconds end-to-end.
As shown in Table 5 the entire CURE operation, including all steps above, completes in under 2 seconds on single GPU. In contrast, methods like (27 29) report 4500s and 500s respectively. CURE is thus orders of magnitude faster, requires no gradient computation, and avoids costly training pipelines. We further note that the runtime independent of image resolution or prompt complexity. making CURE practical for scalable deployment.
D License Information
We will make code publicly accessible. We use standard licenses from the community and provide the following links to the licenses for the datasets and models that we used in this paper. For further information, please refer to the specific link.
Stable Diffusion 1.4: htt.:////nnnnicccccocooooooooocm
* I2P: [ftnryyshhcccmmleeeeaaaaaaeeeiir
P4D: http://aagggeoooacccccccceeoooca 4.0.md
24

---

Ring-A-Bell:
MMA-Difftsionnnttpp/
file
COCO: h
http://aaaaaaoooasooooooooooooos by4.0.md
25


Reviews:
[{"review_id": "TQQs4rW92e", "reviewer": "Reviewer_3v5S", "summary": "This paper introduces a training-free framework for concept unlearning inT2I diffusion models. The core of the proposed method is the Spectral Eraser, a closed-form operator that constructs discriminative subspaces via SVD over token embeddings for concepts to “forget” and “retain”. This operator is used to directly modify cross-attention weights, allowing for efficient erasure of undesired concepts (e.g., NSFW content, styles, objects, or identities) without model training. In addition, the paper introduces a Spectral Expansion mechanism to control forgetting strength via regularization.", "questions": "It would be good to consider adversarial training based concept unlearning [1] as a strong baseline.\n\n[1] Zhang, Y., Chen, X., Jia, J., Zhang, Y., Fan, C., Liu, J., ... & Liu, S. (2024). Defensive unlearning with adversarial training for robust concept erasure in diffusion models. Advances in neural information processing systems, 37, 36748-36776.", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths\n1. The proposed method is mathematically principled and clearly grounded in spectral geometry.\n2. Experiments are comprehensive, covering diverse concepts (artists, objects, identities, NSFW).\n3. The approach is significantly more efficient, requiring only a two-second model edit without retraining.\n\nWeaknesses\n1. While the approach is motivated by geometric intuition and classical regularization, this paper lacks deeper theoretical guarantees (e.g., bounds on erasure effectiveness vs. preservation trade-offs).\n2. The method assumes the embedding space reliably captures concept semantics. If embeddings are noisy or misaligned, the projection could behave unexpectedly.", "was_revised": true, "final_justification": "Authors' reply have solved the my concerns mentioned in the initial review. So I would like to increase the rating to reflect it.", "rebuttal": "We sincerely thank the reviewer for their thoughtful assessment and kind remarks on the clarity, efficiency, and comprehensiveness of our method. We are grateful for the opportunity to address the raised concerns.\n\n### **W1. Lacks Guarantees**\nWe appreciate the reviewer’s suggestion regarding deeper theoretical analysis. Our method is grounded in spectral geometry, and we explicitly connect our spectral expansion operator to Tikhonov-style regularization in Appendix Sec. 1.1–1.2. While our current focus is empirical efficacy and mathematical interpretability (Sec 3.2), extending our framework with formal guarantees on trade-offs between forget and retain subspaces is a valuable direction for future work. We will clarify this as a limitation.\n\n### **W2. Embedding Space Noise**\nWe thank the reviewer for raising this important point. Embedding reliability is indeed a known challenge, as discussed in [1, 2], and we emphasize that the techniques proposed therein to improve embedding quality are fully compatible with our method. Hence they can be integrated with ours to enhance the embedding input to our proposed **Spectral Eraser**.\n\nThat said, for diffusion models like Stable Diffusion, CLIP-based embeddings are widely adopted and have been shown to be semantically rich - serving as the foundation for many state-of-the-art unlearning methods [3–6]. Our own results (Tables 1–4, Appendix Table 1) show that the derived embedding space is sufficiently robust and effective across a range of concept types, including object, style, identity, and NSFW domains. Nonetheless, we will add a clarification to note potential risks when operating on highly out-of-distribution concepts, which may reflect limitations of the underlying text encoder rather than our method itself.\n\nWe thank the reviewer for helping us strengthen this discussion.\n\n### **Q1. Baseline Comparison with Zhang et al. [6]**\nWe appreciate this suggestion and will add a discussion of this work. While adversarial training is effective, it requires retraining as well as careful tuning of hyperparameters and adversarial loss dynamics. Further, authors in AT [6] report that they need 30 attack steps and take 78.57s of train time per iteration for AT, and still 12.13s for FastAT (which reduces their unlearning efficacy). \n\nIn contrast, **CURE** is designed as a training-free, plug-and-play method that performs unlearning at inference time in under 2 seconds, with no access to training data. We emphasize that our method targets a different regime where efficiency, deployability, and editing flexibility are crucial. We will include a discussion of this in our revised draft and highlight the complementary strengths and use cases of CURE versus adversarial unlearning.\n\n\n\nFinally, we sincerely thank the reviewer for their thoughtful, constructive, and encouraging feedback. Your comments raise important points that help surface subtle aspects of our method, and addressing them has helped us improve the clarity and rigor of our work. We are grateful for the opportunity to refine our manuscript in response to your insights and have carefully incorporated your suggestions in our revision.\n\n---\n\n**References:**\n\n[1] Zarei, A., Rezaei, K., Basu, S., Saberi, M., Moayeri, M., Kattakinda, P. and Feizi, S., 2024. *Improving Compositional Attribute Binding in Text-to-Image Generative Models via Enhanced Text Embeddings*. arXiv:2406.07844.\n\n[2] Kang, R., Song, Y., Gkioxari, G. and Perona, P., 2025. *Is CLIP ideal? No. Can we fix it? Yes!*. arXiv:2503.08723.\n\n[3] Gandikota, R., Orgad, H., Belinkov, Y., Materzynska, J., & Bau, D. (2024). *Unified concept editing in diffusion models*. WACV.\n\n[4] Yoon, J., Yu, S., Patil, V., Yao, H., & Bansal, M. (2024). *Safree: Training-free and adaptive guard for safe text-to-image and video generation*. arXiv:2410.12761.\n\n[5] Gong, C., Chen, K., Wei, Z., Chen, J., & Jiang, Y.-G. (2024). *Reliable and efficient concept erasure of text-to-image diffusion models*. ECCV.\n\n[6] Zhang, Y., Chen, X., Jia, J., Zhang, Y., Fan, C., Liu, J., Hong, M., Ding, K. and Liu, S., 2024. *Defensive unlearning with adversarial training for robust concept erasure in diffusion models*. NeurIPS."}, {"review_id": "ZtAZdA4pS5", "reviewer": "Reviewer_eit4", "summary": "In this paper, the authors propose CURE, a training-free concept editing method for machine unlearning in diffusion models. The method operates by patching the key-value matrices of the cross-attention module. This is achieved using a projection matrix designed to filter out the component of embeddings related to the \"forget\" concepts that is orthogonal to the \"retain\" concepts, thereby enabling precise unlearning. Through a series of experiments, the authors demonstrate the effectiveness of CURE compared to several machine unlearning baselines.", "questions": "1. Could the authors provide more detail on how the concept subspaces are determined for each task? For the I2P task, for instance, were the original I2P prompts used directly to define the subspace?\n\n2. What is the minimum number of prompts required to perform a stable Singular Value Decomposition (SVD) for defining the concept subspace?\n\n3. (See Weakness 4) Could the authors justify their choice of a 0.6 threshold for NudeNet, as this differs from the default values used in prior work?", "limitations": "Yes, the authors have adequately addressed the limitations and potential negative societal impact of their work.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 3, "strengths_and_weaknesses": "The primary strengths of this work are as follows:\n\n1. The proposed method is simple yet effective. It directly modifies the key-value matrices, a strategy that incurs no additional computational overhead during inference.\n\n2. The method has demonstrated empirical robustness against advanced prompt attacks, which is a crucial characteristic for any unlearning method to be practically viable.\n\nThe weaknesses of this work are as follows:\n\n1. The evaluation in Table 4 could be more informative. Rather than reporting accuracy across all remaining classes, the analysis would be more compelling if it focused on classes semantically similar to the forgotten class. For unrelated classes, the concept subspaces are likely already orthogonal, which does not effectively highlight the contribution of the proposed orthogonal editing.\n\n2. The experiments do not fully substantiate the paper's central claims regarding the preservation of generation quality. The authors explicitly state in their Problem Setup (Section 3.2) that defining a \"retain set\" R is \"key to preserving model performance on untargeted content when erasing concepts,\" especially when forget and retain concepts share attributes (e.g., $F \\cap R \\neq \\emptyset$). However, most of the key experiments, such as unsafe content erasure and object erasure, do not appear to to define a retain set. This omission is significant because it means the experiments do not test the very mechanism the paper posits for preserving quality. Consequently, the core claim from the introduction (Lines 119-123) that CURE preserves generation quality better than prior works is not adequately supported by the provided evidence.\n\n3. In Table 3, the reported Attack Success Rate (ASR) under the UnlearnDiffAtk benchmark shows MACE (0.176) and SA (0.268) performing best. It is unclear why the result for CURE (0.281) is underlined, as this typically indicates the best performance.\n\n4. The authors should clarify the rationale for using a NudeNet threshold of 0.6 in Table 2, especially when prior works (e.g., ESD, UCE) have used the detector's default value. An explanation for this deviation is needed.\n\n5. The paper is missing a crucial ablation study on the sensitivity of the hyperparameter $\\alpha$.", "was_revised": true, "final_justification": "The authors have addressed all my concerns raised in my initial feedback. After also reviewing the discussion between the authors and other reviewers as well as the supplementary materials, I think the paper meets the conference's standards and I therefore recommend acceptance.", "rebuttal": "We thank the reviewer sincerely for the thoughtful and detailed review. We truly appreciate their recognition of CURE’s simplicity, effectiveness, and robustness, as well as their constructive suggestions for strengthening the evaluation and clarifying the methodology. Their feedback has been valuable in guiding our improvements, and we address each point below in turn.\n\n### **W1. Table 4 Evaluation**\nWe thank the reviewer for this insightful comment. We fully agree that demonstrating generalization across semantically similar concepts is essential to highlight the strength of CURE's orthogonal editing framework. To this end, we refer the reviewer to Figure 5 (from both main paper and appendix), where we evaluate CURE on concepts such as *\"cat\"* and *\"airplane\"*, and test its ability to erase not only the explicit term but also its close semantic variants, such as *\"feline\"* for *\"cat\"*. Notably, baseline methods fail to remove these synonyms, while CURE successfully erases them without affecting semantically unrelated concepts like *\"dog\"* or *\"car\"* respectively. This demonstrates that CURE’s projection operator generalizes robustly within the semantic span of the erased concept subspace.\n\nFurther, we emphasize the strong specificity and fine-grained control CURE enables, even in the presence of overlapping linguistic structure. For instance, in the *\"John Wayne\"* vs. *\"John Lennon\"* case (Figure 5), despite both entities sharing the token *\"John\"*, our method selectively unlearns *\"Wayne\"* while leaving *\"Lennon\"* unaffected, without requiring explicit retention. A similar example is shown in Figure 1 to further supplement this discussion, showing how CURE demonstrates precise concept isolation even when the target and non-target concepts partially overlap in token space. These results supports our core claim: CURE’s projection design geometrically isolates and removes targeted concepts while preserving orthogonal as well as overlapping identities. \n\n\n### **W2. Clarifying the Role of Retain Set**\nWe appreciate the reviewer’s thoughtful observation and use this kind opportunity to further emphasize that CURE is intentionally designed to operate effectively even when the retain set $\\mathcal{R}$ is empty. This is not a limitation, but a deliberate strength of the method. By leveraging the spectral parameter $\\alpha$, CURE prioritizes suppression along the most discriminative directions of the target concept subspace, which implicitly preserves neighboring directions without always requiring explicit supervision.\n\nAs the reviewer insightfully noted in our experiments, this setting mirrors real-world, black-box deployment scenarios where users lack clear or complete definitions of safe concepts to preserve. To demonstrate the method’s robustness in such scenarios, we deliberately omit $\\mathcal{R}$ in key experiments from Tables 1–4. Despite this, results across object, style, identity, and safety domains (Figures 1, 3–5, 7) consistently show that CURE achieves strong erasure of targeted concepts while preserving generation quality on unrelated content. This underscores the practical utility of our method and its resilience in under-specified or weakly supervised settings. However, we leave open the option to specify a retain set if desired, and Figure 6 shows the artist erasure experiment where retain sets were used. \n\nIn the revised manuscript, we will make this capability more explicit in Section 3.2 and include additional qualitative examples featuring more semantically similar distractors to further highlight CURE’s fine-grained precision and generalization. We sincerely thank the reviewer for this insightful observation, which has helped us clarify a key strength of CURE.\n\n\n### **W3. Clarification on Table 3 Formatting**\nWe thank the reviewer for catching this oversight. The MACE results are already in bold in the manuscript to indicate best-performing. The underline under CURE’s ASR for UnlearnDiffAtk in Table 3 was a formatting error - SA (0.268) indeed performs better numerically on this benchmark. We will fix this formatting error in the final version. However, we emphasize that CURE comes very close in performance, offering competitive robustness despite being training-free, unlike MACE and SA, which require expensive gradient-based fine-tuning. We will update the table and clarify this important distinction.\n\n### **W4. Rationale Behind NudeNet Threshold**\nWe appreciate the reviewer’s question regarding the threshold used for NudeNet. Our choice of $0.6$ is deliberate and follows recent practice in the literature [1], where this value has been adopted to better capture borderline NSFW content. This threshold ensures compatibility with safety-sensitive applications by being sufficiently conservative. Importantly, for fairness and consistency, all methods in our evaluation, including baselines, have been assessed using this same threshold. We will clarify this detail in the manuscript. Thank you once again for the helpful suggestion to elaborate on this point.\n\n### **W5. $\\alpha$ Ablation**\nWe sincerely thank the reviewer for this thoughtful suggestion. While we already include analysis of $\\alpha$ variation and its effect on unlearning efficacy in Appendix Section 1.2 and Appendix Figure 1, we agree that this material deserves a more prominent placement to highlight the effect of varying $\\alpha$. In the revised version, we will elevate this analysis to the main paper.\n\nAdditionally, we further test our method on object removal experiments for erasing the concept *\"cat\"* on a set of 100 images across the categories *\"tiger\"*, *\"lion\"*, *\"cheetah\"*, *\"leopard\"*, *\"dog\"*, *\"rabbit\"*, *\"mouse\"*, *\"bird'*, *\"cat\"*, and *\"feline\"*. Here, *\"cat\"* and its semantically aligned synonym, *\"feline\"*, are used to test rigor of the forgetting capability for the Erased (e) concept, while the rest categories are used to test unlearning specificity over Unerased concepts (u). We report LPIPS scores (higher is better for erased concepts, lower is better for preserved ones) and classifier accuracy using GPT-4o (lower is better for erased concepts, higher is better for preserved ones)  as a measure of semantic erasure:\n\n| $\\alpha$ | $LPIPS_e \\uparrow$ | $LPIPS_u \\downarrow$ | $Acc_e \\downarrow$ | $Acc_u \\uparrow$ |\n|----------|--------------------|----------------------|--------------------|------------------|\n| 1        | 0.41               | 0.17                 | 0.47               | 0.96             |\n| **2**    | **0.46**           | **0.19**             | **0.08**           | **0.94**         |\n| 5        | 0.47               | 0.26                 | 0.06               | 0.86             |\n| 10       | 0.49               | 0.27                 | 0.05               | 0.85             |\n| 100      | 0.51               | 0.30                 | 0.00               | 0.86             |\n| 1000     | 0.58               | 0.31                 | 0.00               | 0.85             |\n| $10^8$   | 0.65               | 0.34                 | 0.00               | 0.52  |\n\nAs shown in the table, large $\\alpha$ values enforce strong forgetting but degrade generation quality on unrelated concepts, increasing $LPIPS_u$ and lowering $Acc_u$. In contrast, small $\\alpha$ (e.g., $1$) preserves quality but results in poor forgetting (high $Acc_e$). Notably, $\\alpha=2$ achieves an effective balance: low $Acc_e$ and high $Acc_u$, supporting our design choice of using spectral suppression to control the forgetting strength with a default value of $2$. We will highlight this result more centrally in the revised manuscript to emphasize the practical utility of $\\alpha$ as a single, interpretable control parameter. This simple yet expressive knob enables users to modulate the erasure–retention trade-off without extensive tuning. We thank the reviewer again for encouraging us to better surface this insight and for allowing us to clarify this core strength of our method.\n\n\n### **Q. Subspace Construction and Prompt Count**\nThe prompts for erasing any concept are constructed by substituting the targeted concept into templates such as:\n\n- *\"picture of/by [placeholder]\"*\n- *\"photo of/by [placeholder]\"*\n- *\"image of/by [placeholder]\"*\n- *\"portrait of/by [placeholder]\"*\n\nThis is consistent with prior works [1, 2]. Empirically, we observe using 3–5 diverse prompts suffices to construct a stable and expressive embedding basis.\n\nFor unsafe content erasure, we adopt the prompt *\"violence, nudity, harm\"*, following established protocol in [2] for fair comparison.\n\nWe will incorporate these clarifications in the revised manuscript. We thank the reviewer again for this helpful suggestion, which has allowed us to make our methodology clearer.\n\n---\n\n**References:**\n\n[1] Gong, C., Chen, K., Wei, Z., Chen, J., & Jiang, Y.-G. (2024). *Reliable and efficient concept erasure of text-to-image diffusion models*. ECCV.\n\n[2] Gandikota, R., Orgad, H., Belinkov, Y., Materzynska, J., & Bau, D. (2024). *Unified concept editing in diffusion models*. WACV."}, {"review_id": "ow8YFr2Dut", "reviewer": "Reviewer_jQgH", "summary": "This paper presents CURE, a training agnostic method for removing undesired concepts in diffusion models. At the core of the methodology, CURE leverages SVD before removing out projected features tied to the removal concepts in closed-form without necessitating any model retraining. Additional, experimental results with removing artist styles, explicit content, and etc shows strong performance with minimal impact on unrelated content.", "questions": "The reviewer notes the following questions:\n- The author's note on potential misuse with erase forensic watermarks and how gated model release protocols could potentially address certain misuse. If the authors can expand upon this and further address this issue.", "limitations": "Yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "The reviewer notes the following strengths and weaknesses.\n\nStrengths:\n- CURE is a training-free method for concept unlearning that is shown to be effective across a wide range tasks (i.e. artist style, nudity, and etc).\n- The underlying methodology is mathematically sound & intuitive as well as shown to be able preserve the non-removed concepts.\n- The paper is well-written and provides extensive empirical evaluation across multiple tasks and comparative methods.\n\nWeaknesses:\n- The reviewer is concerned about the computational overhead of SVD and closed-form calculations.\n- Additionally, certain hyperparameters (such as alpha) may be difficult to find reasonably in practice.", "was_revised": true, "final_justification": "The proposed CURE method provides a mathematically rigorous foundation for applying a empirically strong method for removing undesired concepts in diffusion models. Given the technical soundness and the strong mathematically intuitive foundations for the methodology, I believe the paper merits acceptance.", "rebuttal": "We sincerely thank the reviewer for their thoughtful and constructive feedback. We are grateful that you found CURE to be a mathematically sound, training-free framework with broad applicability and strong empirical performance. We also appreciate your recognition of the clarity of the paper and its contributions across multiple concept types.\n\nBelow, we address your concerns regarding computational overhead, the choice of $\\alpha$, and the request for further discussion on potential misuse of concept removal. We also provide clarifications and supporting details where appropriate, and look forward to revising the paper to incorporate these improvements.\n\n### **W1. SVD and Closed-form Overhead**\n\nWe are grateful for the reviewer’s insightful observation on the potential overheads. In practice, SVD is performed only once offline over the token embeddings of concept prompts, which are short in length (typically $< 10$ tokens) and embedded into a 768-dimensional space. Thus, the actual SVD computation is extremely lightweight—on the order of milliseconds on a CPU—and not a bottleneck. Once the forget/retain subspaces are computed, the weight projection is a one-time linear algebra operation, requiring under 2 seconds on GPU for all layers. We will clarify this with timing details in the revised text.\n\nWe further provide supporting details for this:\n\n- **Step 1: Token Embedding Extraction.**  \n  For each concept to be forgotten (e.g., *\"cat\"*), we extract token embeddings using Stable Diffusion’s text encoder. This typically results in a small matrix of size $\\text{n}_{\\text{tokens}} \\times 768$. For example, the prompt *\"cat”* yields 2 tokens, which can be expanded using related phrases like *\"a picture of [placeholder concept]\"* to around 6 tokens. This step is equivalent to a single text encoder forward pass and takes less than 0.1 seconds.\n\n- **Step 2: SVD Computation.**  \n  We perform reduced SVD on the token matrix (e.g., $6 \\times 768$), retaining top-$k$ components (typically $k \\leq 5$). This computation is lightweight and completes in under 0.5 seconds on a single GPU using standard libraries like `torch.linalg.svd`.\n\n- **Step 3: Projection Operator Construction.**  \n  We construct the projection matrix $P_{\\text{forget}} = U_k U_k^\\top$ and apply spectral expansion with strength parameter $\\alpha$ (e.g., $\\alpha = 2$). This matrix operation is inexpensive and completes in less than 0.1 seconds.\n\n- **Step 4: Cross-Attention Weight Update.**  \n  We apply the resulting operator to the key and value weights in the cross-attention layers of Stable Diffusion’s U-Net. Since the edit is closed-form and affects a fixed number of layers, the update takes roughly 1.2 seconds end-to-end.\n\nAs shown in Table 5, the entire CURE operation, including all steps above, completes in under $2$ seconds on a single GPU. In contrast, methods like [1, 2] report $\\sim 4500$s and $500$s respectively. CURE is thus orders of magnitude faster, requires no gradient computation, and avoids costly training pipelines. We will clarify this low overhead more explicitly in the revision and note that the runtime is independent of image resolution or prompt complexity, making CURE practical for scalable deployment.\n\n### **W2. Practicality of Choosing $\\alpha$**\n\nWe acknowledge the reviewer’s concern about the practicality of tuning $\\alpha$, which governs the strength of spectral expansion. In practice, $\\alpha$ is fixed to 2 for all experiments, as stated in Line 210, with the only exception being NSFW content, where stronger erasure is desired and $\\alpha$ is set to 5. This demonstrates minimal hyperparameter tuning and supports the robustness of our method across diverse concept types.\n\nMoreover, we additionally sweep $\\alpha$ in Appendix Sec. 1.1–1.2 to show graceful degradation/improvement curves. For CURE, $\\alpha$ provides a **single**, interpretable control knob.  If users do not wish to use our default suggested value of 2, they are given control over their value of choice depending on their tolerance for trade-offs between erasure strength and retention. We will clarify usability of the default $\\alpha$ choice as well as free control to change it if desired more clearly in the main text and supplement. We are grateful to the reviewer for giving us the opportunity to clarify this design choice and reaffirm the practical robustness and interpretability of our approach.\n\n### **Q1. Ethical Misuse Discussion**\n\nWe appreciate the reviewer raising this critical point. In Sec. 5, we explicitly mention potential misuse, such as erasing forensic marks or safety tags. While our method can erase any concept tied to an embedding, its effectiveness depends on having a precise textual representation of the concept. This makes arbitrary backdoor or watermark removal non-trivial unless the attacker already knows what to target.\n\nFor sensitive applications, we agree that further stronger safeguards must be considered. We will expand our discussion on mitigation strategies, such as:\n\n- using prompt filtering to prevent unlearning protected tokens  \n- integrating gating mechanisms into model release protocols, where CURE is sandboxed for permitted concepts only\n\nWe will elaborate on this in Sec. 5 and discuss how CURE’s transparency (closed-form, user-visible edits) makes it easier to monitor and audit compared to opaque fine-tuning-based methods. We thank the reviewer once again for highlighting this important dimension of safety and trustworthiness, which we believe is essential for for controlled and accountable concept editing.\n\n---\n\n**References**\n\n[1] R. Gandikota, J. Materzynska, J. Fiotto-Kaufman, and D. Bau, “Erasing concepts from diffusion models,” in *Proceedings of the IEEE/CVF International Conference on Computer Vision*, pp. 2426–2436, 2023.\n\n[2] N. Kumari, B. Zhang, S.-Y. Wang, E. Shechtman, R. Zhang, and J.-Y. Zhu, “Ablating concepts in text-to-image diffusion models,” in *Proceedings of the IEEE/CVF International Conference on Computer Vision*, pp. 22691–22702, 2023."}, {"review_id": "hhcTuZedDQ", "reviewer": "Reviewer_qJh8", "summary": "This paper presents and evaluates a concept unlearning method (CURE) for text-to-image diffusion models. Conceptually, the method uses the projection of the text embeddings for an input prompt onto a basis for the subspace spanned by the concepts to be unlearned. Specifically, they \"subtract out\" the projection onto the unlearned concept and \"add back in\" the projection onto the intersection between unlearned concepts and concepts to be preserved. Because this can be directly encoded in the cross-attention weights, it is an efficient, one-time operation to unlearn a concept while retaining related ones.", "questions": "No particular questions, but feel free to address any of the points above", "limitations": "yes", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "# Strengths\nThe proposed method is simple and appears to be highly effective. Each component of the method is well-motivated and clearly explained. The experiments are thorough, though I'm not well-positioned to evaluate the particular models and datasets used.\n\n# Weaknesses\nThe user must explicitly provide concepts to be preserved, which may end up being a large set. The authors provide experiments in which they have empty preserved sets, and the results still look fairly good. It could help to make this more explicit in the text.\n\nI would have liked to see experiments showing the effect of varying $\\alpha$ on both image and unlearning quality.\n\n# Minor comments\n- l. 71: \"an singular-value\" -> \"a singular-value\"\n- l. 226 \"a 1000\" -> \"1000\"", "was_revised": true, "final_justification": "Having read the other reviews and the authors' responses, I continue to believe that this paper meets the bar for publication. I am not updating my score because it was already high.", "rebuttal": "We sincerely thank the reviewer for their positive and thoughtful evaluation. We are encouraged and deeply grateful that they found CURE to be a simple, effective, and a well-motivated concept unlearning method, with clear explanations and comprehensive experiments. Below, we respectfully address the reviewer’s suggestions and clarify points raised.\n\n### **W1. Making Usage of Retain Set Explicit in Text:**  \nWe appreciate the reviewer’s insightful observation and agree that the optional role of the retain set $\\mathcal{R}$ could be made more explicit in the main text. While $\\mathcal{R}$ provides users with an optional knob for fine-grained control, its use is *not required* for CURE to be effective. As you kindly noted, many of our evaluations (e.g., Tables 1–4) use an empty retain set, and still demonstrate strong forgetting performance with minimal degradation to unrelated concepts. This design choice was intentional to ensure that CURE remains lightweight and user-friendly, even without detailed concept annotations. We will revise the paper to better emphasize that specifying the retain set is optional. Thank you for encouraging us to clarify this point.\n\n\n### **W2. Ablation on $\\alpha$ Variation:**  \nThank you for this valuable suggestion. While we included analysis on varying $\\alpha$ on unlearning quality in Appendix Sec. 1.2 and Appendix Figure 1, we agree this visualization could be made more central. We also agree that more explicit experiments on the effect of varying $\\alpha$ on image quality would enhance the paper. To this end, we plan to include both a Figure and a Table to quantify this trade-off. However, NeurIPS instructions prevent us from linking to an external page that would be necessary to host the Figure for your viewing. Hence, we will include this Figure in the revision. For the Table, we provide it below, where our method is tested on object removal experiments for erasing the concept *\"cat\"* on a set of 100 images of categories *\"tiger\"*, *\"lion\"*, *\"cheetah\"*, *\"leopard\"*, *\"dog\"*, *\"rabbit\"*, *\"mouse\"*, *\"bird\"*, *\"cat\"* and *\"feline\"*. Here, *\"cat\"* and its semantically aligned synonym, *\"feline\"*, are used to test rigor of the forgetting capability for the Erased (e) concept, while the rest categories are used to test unlearning specificity over Unerased concepts (u). We report LPIPS scores (higher is better for erased concepts, lower is better for preserved ones) and classifier accuracy using GPT-4o (lower is better for erased concepts, higher is better for preserved ones) as a measure of semantic erasure:\n\n| $\\alpha$ | $LPIPS_e \\uparrow$ | $LPIPS_u \\downarrow$ | $Acc_e \\downarrow$ | $Acc_u \\uparrow$ |\n|----------|--------------------|----------------------|--------------------|------------------|\n| 1        | 0.41               | 0.17                 | 0.47               | 0.96             |\n| **2**    | **0.46**           | **0.19**             | **0.08**           | **0.94**         |\n| 5        | 0.47               | 0.26                 | 0.06               | 0.86             |\n| 10       | 0.49               | 0.27                 | 0.05               | 0.85             |\n| 100      | 0.51               | 0.30                 | 0.00               | 0.86             |\n| 1000     | 0.58               | 0.31                 | 0.00               | 0.85             |\n| $10^8$   | 0.65               | 0.34                 | 0.00               | 0.52  \n\nAs shown in the table, large $\\alpha$ values enforce strong forgetting but degrade generation quality on unrelated concepts, increasing $LPIPS_u$ and lowering $Acc_u$. In contrast, small $\\alpha$ (e.g., $1$) preserves quality but results in poor forgetting (high $Acc_e$). Notably, $\\alpha=2$ achieves an effective balance: low $Acc_e$ and high $Acc_u$, supporting our design choice of using spectral suppression to control the forgetting strength with a default value of $2$. We sincerely appreciate the reviewer’s comment which has helped us clarify this important phenomenon and will highlight the result more centrally in the revised manuscript to show the effect of $\\alpha$ variation. \n\n### **Minor Edits:**  \nWe thank the reviewer for pointing out the typos at Line 71 and Line 226. These will be corrected in the camera-ready version.\n\nFinally, we sincerely appreciate the reviewer’s thoughtful engagement and valuable suggestions for CURE. Your feedback has meaningfully sharpened the clarity and practical framing of our contributions. We look forward to incorporating these refinements in the revision, and thank you again for your constructive and supportive review."}]

Author rebuttal:

Meta-review: This submission proposes a new algorithm for concept unlearning in diffusion models grounded in spectral geometry. The algorithm itself is a closed-form update based on subspaces determined via SVD for both “forget” and “retain” concepts. Similar to other closed-form update algorithms in the literature this only operates on the cross-attention weights which results in highly efficient unlearning. Additionally the paper proposes a novel mechanism for controlling the amount of forgetting which has only been seen in a limited set of papers in the prior literature. 

The strengths of this paper as noted by reviewers and myself are in (1) the motivation for this method using spectral geometry compared to other concept unlearning algorithms, (2) the success of the algorithm across a variety of tasks and concepts, and (3) the efficiency of the algorithm even compared to other existing closed-form algorithms.

The weaknesses of this paper were addressed across the board during the rebuttal. Initially these included specifics about certain tasks like the threshold chosen threshold in the explicit content task, the lack of theoretical guarantees, and how practitioners might approach tuning the hyperparameters such as alpha. The reviewers found responses to these weaknesses satisfactory and are all in agreement that this paper should be accepted. I am in agreement and I am additionally nominating this paper for a spotlight award. I have gone through the paper myself and I believe that the rigorous grounding in spectral geometry will be valuable for the concept unlearning community to build on further our understanding of T2I unlearning. Thank you to the authors for submitting to this work to NeurIPS.
Decision: Accept (spotlight)