When Are Concepts Erased From Diffusion Models?
Authors: Kevin Lu
Nicky Kriplani
Rohit Gandikota
Minh Pham
David Bau
Chinmay Hegde
Niv Cohen
Venue: NeurIPS 2025 poster ()
Keywords: Concept Erasure
Primary area: deep_learning
TL;DR: We introduce evaluations that reveal limitations in how diffusion models erase concepts.

Abstract: In concept erasure, a model is modified to selectively prevent it from generating a target concept. Despite the rapid development of new methods, it remains unclear how thoroughly these approaches remove the target concept from the model. We begin by proposing two conceptual models for the erasure mechanism in diffusion models: (i) interfering with the model’s internal guidance processes, and (ii) reducing the unconditional likelihood of generating the target concept, potentially removing it entirely. To assess whether a concept has been truly erased from the model, we introduce a comprehensive suite of independent probing techniques: supplying visual context, modifying the diffusion trajectory, applying classifier guidance, and analyzing the model's alternative generations that emerge in place of the erased concept. Our results shed light on the value of exploring concept erasure robustness outside of adversarial text inputs, and emphasize the importance of comprehensive evaluations for erasure in diffusion models.

When Are Concepts Erased From Diffusion Models?
Kevin Lu'
Nicky Kriplani
Rohit Gandikota
Minh Pham²
David Bau'
Chinmay Hegde
Niv Cohen
Northeastern University
New York University
Abstract
In concept erasure, model is modified selectively prevent it from generating target concept. Despite the rapid development of new methods, remains unclear how thoroughly these approaches remove the target concept from the model. We begin by proposing two conceptual models for the erasure mechanism in diffusion models: (i) interfering with the model's internal guidance processes, and (ii) re- ducing the unconditional likelihood of generating the target concept, potentially removing it entirely. To assess whether concept has been truly erased from the model, we introduce a comprehensive suite of independent probing techniques: supplying visual context, modifying the diffusion trajectory, applying classifier guidance, and analyzing the model's alternative generations that emerge in place of the erased concept. Our results shed light on the value of exploring concept era- sure robustness outside of adversarial text inputs, and emphasize the importance of comprehensive evaluations for erasure in diffusion models
Introduction
Original Model
Guidance Based Erased Model
Destruction Based Erased Model
Target Concept
Diverting away from Target Concept
Suppressing Target Concept Likelihood
Knowledge traces present
Knowledge removed
Figure suggest that diffusion model concept erasure methods can be broadly categorized into two types: (1) Guidance-Based Avoidance, which avoids concept by redirecting the model to different concept locations. (2) Destruction-Bass Removal, which reduces
unconditional likelihood of the target concept while keeping guidance intact, forcing the model to another concept when prompted with the target concept. The height represents the unconditional likelihood P(X).
When concept is supposedly erased from diffusion model, its knowledge truly removed? Or is the model merely avoiding the concept, with the underlying knowledge still intact? This fundamental question is at the heart of understanding erasure in diffusion models.
Source code and datasets can be found at ReeiinllsSSWWhhccckeCCCoeessrree
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Investigating this question is crucial as it directly impacts how we evaluate the thoroughness of unlearning methods in text-to-image diffusion models, pushing us towards more rigorous standards. Furthermore, a clear understanding of the underlying erasure mechanisms will enable us to advance research, paving the way for stronger and more robust unlearning techniques.
To help analyze how erasure might affect the underlying model's knowledge, we propose two conceptual mechanisms for erasure methods: guidance-based avoidance and destruction-bused re- moval. Guidance-based avoidance suggests that the model learns to steer its generation away from the target concept by modifying the conditional guidance, which may leave the core knowledge preserved. In contrast, destruction prabru removal implies that the process aims to fundamentally suppress, or ideally, eliminate the underlying knowledge about the concept (see Figure D
Distinguishing between these regimes is not straightforward: both can appear visually successful when tested with standard prompts. Prior research [18] 26 29 20 has shown that erased concepts can be resurfaced by searching for the right input, suggesting that most existing methods act through guidance-based avoidance rather than destruction-based removal. Yet these findings, while reveal- ing, leave open a question: if the underlying knowledge persists, through which other methods might uncover it? Can it re-emerge through other techniques as well?
We suggest a multi-perspectivee approach for testing for persistent knowledge. First, we employ existing input optimization techniques, including textual inversion and prompt-based adversarial attacks, to actively search for inputs that might still trigger the generation of the erased concept. Second,
context-based probing, where the model is provided with contextual cues related to the erased concept. For example, through inpainting tasks or by initiating the diffusion process from an intermediate step. Conditioned such context, see if the edited model can complete gen- erate the concept. Third, we explore training-free trajectory expansion, which broadens the model's standard diffusion pathways to potentially uncover latent or suppressed concept representations. Fourth, we employ latent classifier guidance, augmenting text conditioning with gradients from a concept-specific latent classifier. This provides powerful signal that steers the diffusion trajectory toward residual concept latents, counteracting crasure-induced guidance that drives the model away. Finally, our suite includes dynamic concept tracing to monitor how a concept's 's representation and its likelihood of generation evolve throughout the entire crasure procedure.
Our findings reveal undiscovered behavior of models under these new evaluation contexts. For in- stance, models that appear robust under traditional input search techniques remain vulnerable when assessed from other perspectives. These observations emphasize the critical need for compre- hensive suite of evaluations, like the one we propose, to reliably assess the completeness and true effectiveness of any concept erasure method.
2
Two Conceptual Models for Erasure
Here, we formalize two conceptual models that capture how diffusion model erasure methods can modify the generative process: guidance-based avoidance and destruction- -based removal. While recent works have proposed numerous erasure algorithms (see Section 4 for a review), they are typically described by their training losses, data requirements, or parameter modifications [8] 26 Often, less attention is given to their effect on the resulting model behavior. Here, we instead focus on their functional effect the model's output distribution.
19 10
We term methods that redirect the model's conditional guidance rather than eliminate the concept itself as guidance-based approaches. Accordingly, such approaches may still regenerate the erased concept when given optimized inputs or alternative cues. Destruction-based approaches, contrast, aim to suppress the model's 's unconditional likelihood P(X) of producing the erased concept. Such methods correspond to a deeper removal of underlying features (and potentially broader collateral effects nearby concepts).
For example, we examine Unified Concept Erasure (UCE) 10 as a representative case of guidance- based erasure. UCE optimizes a new attention projection matrix W using the following loss:
L(W)=
Σ |e: 12 C
Σ [ee
WWaccyl?
SEP
where and P denote erased and protected concepts, respectively. The first term aligns erased con- cept embeddings e with neutral or substitute vectors vi,, while the second term preserves responses
2

---

for protected prompts cj. This effectively shifts the model's 's conditional distribution from P(X (.) P(X ct), where of represents a neutralized prompt (e.g., an empty string).
Because the erased concept's representation is redefined through a substitute projection, UCE al- ters the semantic associations between text tokens and their corresponding visual features rather than eliminating the features themselves. The edited projection matrix W' effectively redirects the model's conditional mapping from the erased concept toward a neutral or generic concept. As re- sult, the model's output distribution P(X) exhibits redirection rather than complete suppression: the conditional generation shifts from the erased concept's 's toward different one. Therefore, UCE exemplifies guidance-bar baeed approach the underlying concept remains present but the generation guided away from under standard prompts.
However, for methods whose post-erasure behavior is less interpretable, such as STEREO 26 it becomes less clear whether suppression arises from guidance redirection or true knowledge de- struction. To empirically differentiate these regimes, we next introduce comprehensive evaluation framework that probes multiple pathways through which erased knowledge could resurface. By us- ing many different probing techniques and checking which can still recover the erased concept, we assess the extent and character of the model's residual knowledge, and whether an erasure method behaves more like guidance-bass basedd avoidance or destruction-banl based removal.
Evaluation Suite
We present our evaluation suite and apply it to representative set of existing crasure methods. We choose methods that represent different approaches, but our evaluations can be easily applied to any new or existing method. Specifically, we evaluate the following erasure methods:
Unedited Stable Diffusion 1.4 model (no erasure); UCE [0] A closed-form so- lution editing of the cross-attention weight in the model to replace the target concept and preserve other concepts; ESD-u [ fine-tunes the pre-trained diffusion U-Net model weights to remove specific style or concept when conditioned on a specific prompt; ESD-x (8] fine-tunes only the cross-attention layers, modifying how textual conditioning influences latent feature modulation; Task Vector [19]- Finetuning the U-net to increase the likelihood of the target concept. and then edit- ing the model in the opposite direction using the Task Vector technique [15]; GA direct gradient ascent to reduce the likelihood of the target concept; STEREO (26 A two-stage method com- bining adversarial prompt search with compositional fine-tuning to robustly erase concepts while preserving model utility; RECE [12] A fast, closed-form method that iteratively applies UCE on text embeddings while minimizing impact on unrelated concepts.
Baseline 20
Concepts we conduct our experiments on 10 object concepts and 3 art styles. We report average results in the main text, and standard deviation in the supplementary materials. Metrics CLIPP evaluate semantic similarity of the output image to the target concept name (14); Classification Accuracy: We detect the presence of the concept in the generated image using an ImageNet classifier for object concepts. For the specificity of model erasure, we measure how the crasure affects other unrelated concepts via CLIP and classification scores). Please see App|C for all model training, erasing evaluation, and metric calculation implementation details.
We refer to each of the following tests as a distinct probe: designed to challenge the examined erasure method and reveal the underlying behavior of different methods.
3.1 Optimization-basee Probing
Question 1: Can we probe out the residual knowledge by searching for the right input?
We evaluate this question by adopting strategies from previous works 18 optimize the inputs of the erased model to search for the right trigger that would resurface the knowledge of the erased concept, if still present. To this end, we use Textual Inversion (6) and an
These methods
adversarial attack, UnlearnDiffArk (32) Both these methods optimize the text embeddings or tokens to generate the erased concept using the erased model. We use them as probes to quantify if there are traces of knowledge present post-erasure, done in prior work [18).
3

---

The results in Table 1 reveal stark dichotomy of how various methods withstand optimization- based probes. GA, TV, and STEREO exhibit thorough removal of the erased concept, as indicated by the lower CLIP similarity and classification accuracies across both probes. In contrast, methods such as UCE and ESD-x remain highly vulnerable to both Textual Inversion and UnfearnDiffAtk, with high classification accuracy and CLIP scores, suggesting that residual knowledge of the target concept persists. Moreover, a consistent trend emerges: models that are more robust to adversarial probing often suffer greater degradation in their performance unrelated concepts (see Fig. g in
App C.3.3).
GA
UCE
ESD-x
ESD-u
Tas
STEREO
RECE
Erased Concept (1)
CLIP
24.3
22.4
21.1
20.9
23.1
19.6
21.15
Class Acc. (%)
0.6
4,4
3.6
1.0
2.2
0.0
4.0
Textual Inversion (4)
CLIP
22.7
30.7
30.6
28.0
25.1
24.5
29.15
Class Acc. (%)
0.6
71.2
65.9
31.8
6.2
6.3
58.20
UnlearnDiffAtk (L)
CLIP
26.0
28.3
28.7
27.8
27.1
26.1
27.9
Class Acc. (%)
6.5
26.8
21.0
16.6
10.3
3.7
7.2
Unrelated Concepts (1)
CLIP
28.8
31.2
30.8
30.7
29.4
0.0
30.5
Class Acc. (%)
52.2
75.0
71.3
70.4
60.4
52.8
71.7
Table 1: Optimization-basee probing residual concept knowledge across erasure methods. We evaluate whether erased concepts be resurfaced using standard prompts, Textual Inversion, and the UnlearnDif'Atk adversarial attack. The final row shows performance on unrelated concepts (f),
measuring the preservation of general model utility.
Base Image
SD 1.4
UCE
ESD-x
ESD-u
GA
TaskVoc
STEREO
RECE
Vao Gogh
Pieasso
Church
Figure 2: Inpainting based probe results for multiple erased concepts. For each method and concept, the masked region is filled by the model conditioned on surrounding context. Task Vectors success- fully reconstructs the erased region, despite robustness to Textual Inversion and UnleamDiifAtk.
3.2 In-context Probing
Question 2: Can probe out the residual knowledge by providing visual context?
We investigate whether erased concept resurface when the model is provided with single visual in-context example. This question drives our application of visual in-context cues to evaluate the depth and thoroughness of concept erasure (a technique also explored in prior works [1] 23) Unlike optimization- based approaches, these method do not use the networks gradients, thereby providing different lens erasure efficacy.
First, we use Inpainting as an in-context probe for erasure. We provide the model with an image corresponding to the concept, but with portion of image masked out. When the model truly has

---

Prompt: "A painting in the style of Van Gogh"
Input
UCE
ESD-x
ESD-u
Ves
STEREO
RECE
Timestep of original image context
5-5
[-10
Figure 3: Diffusion Completion outputs given intermediate images generated at timestep by the original (unerased) model. These noisy inputs are visualized the first column the Denoising Trajectory (DT) 7 technique. We then pass each of these unfinished images as contextual inputs to the erased models to complete the remaining denoising steps.
no knowledge of the concept, we assume should not correctly inpaint the image. Figure shows that the Task Vector method, for example, despite being robust against Textual Inversion, still inpaints recognizable images of Starry Night by Van Gogh. This is reflected in Table 2 where Task Vectors achieve inpainting CLIP scores comparable less adversarially robust models. In contrast, STEREO and GA produce little to no meaningful inpainting.
Next, we use Diffusion Completion as another in-context probe by leveraging unfinished image generations from the unerased base model. Specifically, we run the diffusion process with the base model for & then passed to the erased model to complete the generation. This approach allows us to quantify how easily the erased concept can be recovered from partial generation traces. Figure (aare3]shoo shows that RECE and STEREO, despite offering significantly stronger robustness to adversarial attacks compared to methods like UCE, ESD-x, and ESD-u, u, surprisingly reproduce knowledge about the erased concept during Diffussonn Completion at t and = 10 respectively.
10 timesteps (out of 50) and save the intermediate image. This image is
Given their performance under optimization-hasee probes, models such as Task Vector, STEREO, and RECE, appeared to have significantly destroyed traces of erased concepts. However, these context- based probing methods reveal more nuanced model behavior. They offer a complementary perspective to traditional prompt optimization approaches, suggesting that erasure robustness can depend on the nature of the input signal.
Metric
Base
UCE
ESD-x
ESD-u
GA
Task
STEREO
RECE
Inpainting (1)
CLIP (Inside mask)
29.5
26.9
26.8
23,9
24.8
25.9
22.7
26.3
Class Acc. (%)
77.7
69.1
69.1
68.5
61.7
66.8
63.8
68.2
Diffusion Completion (L)
CLIP
30.2
27.7
27.2
26.9
24.0
23.8
28.82
CLIP 1=10
30.2
29.6
28.7
27.5
24.5
24.9
27.8
28.82
Class Acc. (%) 1=5
f=5
78.0
42.7
37.8
32.5
1.1
2.4
3.2
36.5
Class Acc. (%) 1=10
78.0
62.1
54.8
36.9
3.2
6.1
21.2
45.4
Table 2: Inpainting metrics evaluate how well the model completes masked region when given surrounding context from an image of the erased concept; CLIP scores reflect semantic similarity within the masked area, while classification accuracy considers the full image. Diffission Completion metries evaluate whether crased concepts resurface when the erased model completes the diffusion process starting from an intermediate image produced by the original model after 5 10 out of 50 denoising steps.

---

XT
XT-1
X--2
X
X
---1
X
Ry-2
X0
Original Trajectory
Diffusion Denoising Step
Noise-Based Probe Trajectory
Random Gaussian Noisc
Figure 4: Our Noise-Based probing technique adds additional noise to the diffusion trajectory. At every diffusion denoising timestep, we add back a controlled amount of noise to allow the model to search in larger latent space.
3.3 Training-Fres Free Trajectory Probing
Question 3: Can probe out the residual knowledge by modifying diffusion trajectory?
We introduce Noise-Based probing, a method to probe for residual knowledge by directly manip- ulating the model's generation process. This technique searches for hidden knowledge traces by augmenting the diffusion trajectory. Namely, allow the model to explore alternative generation pathways by simply add Gaussian noise to the intermediate latents after each denoising step:
ă1-1 (Øc aCD) + TE
where acp represents the standard denoising process, and N/C represents additional Gaussian noise scaled by parameter y (we explore seven values of 1J in the range [1.0, 1.85]; see App- D.3 To account for this change and still generate high-quality images, we also scale the diffusion process scheduler variance by and motivate this probing method based the DDIM formulation in Ap-
pendix B
As illustrated in Fig. this approach performs controlled exploration of the model's latent space through Brownian motion along the diffusion trajectory. an edited model's trajectory simply de- viates away from concept, noise-probe may help expand the diffusion trajectory bandwidth and find again the better (higher likelihood) images associated concepts. other words, the in- jected noise may enable the model surface concepts it otherwise suppresses. We emphasize this probe does not optimize an adversarial input or present visual cues, and therefore offers an indepen- dent perspective into the internal knowledge of the model. Due the random nature of this probe, we execute it multiple times and select the generated image with the highest CI.PPcllasiiiiction score relative the target concept.
Surprisingly, this simple method can reveal traces knowledge cases where even powerful optimization-based methods fail. E.g., while adversarially optimized probes fail to recover erased concepts in models like GA and STEREO, the noise-based probe applied to the same prompt and seed successfully restores them (Fig Table shows that Gradient Ascent and STEREO exhibit the strongest robustness against noise- based probing.
GA
UCE
ESD-x
ESD-u
Task
STEREO
RECE
Noise-Based Probing (L)
CLIP
27.8
28.0
27.7
26.5
24.6
27.0
Class Acc. (%)
2.67
21.9
30.7
27.7
11.0
1.1
13.0
Table 3: Noise-based probing results. Remarkably, simply increasing the stochasticity of the diffu- sion process, while keeping the same prompt and seed, can bring erased concepts back. This effect is particularly pronounced for UCE, ESD-x, and ESD-u, indicating that these methods retain recov- erable latent traces of the crased concept.

---

Prompt "a picture of church"
UCE
ESD-x
ESD-U
GA
Task
STEREO
RECE
Standard Prompt
Textual
Inversion
Noise- Based UnlcurDDift
Figure 5: An overview erasing model behavior under adversarial probes and the Noise-Based probe. Our Noise-Based probe can recover the target concept ("church") even in cases where Textual Inversion and UnlearnDiffArk fail.
3.4 Steered Latent Probing
Question 4: Can we probe out the residual knowledge using by classifier guidance?
To probe whether erased models still encode latent traces of the target concept, we apply a variant of classifier guidance in latent space 4 Instead of relying solely on text conditioning, we train a lightweight classifier directly in latent space (see Appendix D.5 for details). This classifier provides gradient signal that steers the diffusion trajectory toward regions of latent space associated with the erased concept.
At each denoising step t, the current latent x, is passed to a timestep-aware classifier fo- (x+, t) trained to detect the target concept c*. For each latent, the classifier outputs a probability fee (X,, t) [0, 1] indicating the presence of the concept. To obtain semantic direction that increases classifier confidence in the concept, we compute the gradient of the binary cross-entropy loss with respect to the latent, using target label y=1 that denotes the concept's 's presence:
g Xx, LCc (x,, t), y=1,
This gradient defines a local direction in latent space that points toward regions the classifier identi- fies as belonging to the erased concept.
We use the obtained gradient (Fq. 3 to update the latent at each timestep:
E. 3C - Solf df ge.
(4)
where Self the guidance strength and o, controls the effective step size according to the current noise level (following Dhariwal and Nichol (4).
During inference, we sweep over 24 values of sar and select the sample with the highest classifica- tion score for the target concept. Interestingly, models trained with STEREO, which are robust to Textual Inversion and UnleamDiffAAt. seed and the original prompt when guided by this latent classifier (Table
still regenerate the erased concept from fully noised
When combined with the Noise-Based Probe (Section 3.3 classifier guidance further amplifies recovery, yielding roughly a 1.5x increase classification accuracy for UCE, ESD-X, and ESD-U relative to standard classifier guidance alone.
7

---

The cussifier-guidees probe provides a powerful test of residual knowledge: rather than altering the text or context, it steers the model directly within its latent space. We note, however, that as discussed in Section 5 optimization-ban basedd probes such as this one may recreate concept-like outputs through the optimization process itself rather than strictly reveal residual representations.
Metric
GA
UCE
ESD-x
ESD-u
Task
STEREO
RECE
Standard Classifier Guidance (1)
CLIP
26.3
28.2
28.1
28.1
27.6
25.7
27.1
Class Acc. (%)
3.7
45.6
47.8
46.7
30.2
5.8
33.3
Classifter-uudde Noise-Based Probing (1)
CLIP
26.5
29.1
28.6
28.4
27.8
27.1
27.2
Class Ace. (%)
4.1
75.6
73.3
59.1
35.1
20.3
36.7
Table 4: Classifier-guti -uiied probing results. Standard classifier guidance alone reveals residual cept signals across several erasure methods, while combining it with noise-based probing (Classifier- Guided Noise Probe) further amplifies the recovery of erased concepts. Notably, classification scores of recovered concepts for STEREO are more than double those achieved by Textual Inversion.
Prompt "a picture of an airliner"
UCE
ESD-x
ESD-u
Tas
STEREO
RECE
Standard Prompt
Standard CG
Based Probe
CG Noise
HIF
Figure 6: Classifier Guidance (CG) with Noise-Based probes significantly improves the visual fi- delity and semantic accuracy of recovered airplane concepts. Generated airplanes exhibit more realistic structural features and better-defined geometries compared to the baseline method (particu- larly for Task Vectors and STEREO).
3.5 Dynamic Concept Tracing
Question How does a concept evolve when progressively being crased?
We analyze the trajectories of the alternative generations different erasure strengths. Namely, we prompt the model at different stages using the concept name in the prompt and inspect the resulting images. We find that methods which perform more robust crasure when evaluated using other probes tend degrade the concept more consistently. That is, Gradient Ascent and Task Vector often converge to generate similar images along the trajectory, and these images degrade in quality as the erasure progresses. In contrast, methods that tend behave in way more similar to the guidance- based avoidance conceptual model exhibit more abrupt transitions between alternative generations. Namely, ESD-u and ESD-x produce more varied outputs when prompted with the erased concept (Fig. (7). To validate this observation, we measure the distance between CLIP embeddings of images generated by the original (unedited) model and those from the edited models (see App. (D6)).
One potential way to understand this result is through the nature of the erasure mechanism. ciaruction-based methods may create 'dip' in the unconditional likelihood landscape by reduc-

---

ing the probability of generations containing the target concept (see right panel, Fig. D This may supress the generation probability not only for the target concept but also for semantically nearby concepts. Consequently, stronger erasure (deeper 'dips") may drive alternative generations further from the original concept. In contrast, guidance- -baseeeeeeb-eddd--ee methods interfere with the guidance meeh- anism, but not necessarily with the unconditional probability. They may have less impact on the generated image structure while more significantly affecting which specific generation selected.
We note that this possible explanation relies on assuming a given method is guidance- or destruction- based. Yet, the categorization of any specific method one of our conceptual mechanisms remains tentative. While we believe concept tracing provides valuable complementary insight into erasure dynamics within our evaluation suite, drawing exact conclusions on the underlying mechanisms requires further study.
0%
10%
20% %
30 %
%
50 %
60 %
70
80 %
90% %
100 %
GA
TV ESD-u ESD-x
Figure 7: When comparing generations as concepts are progressively erased, the differences be- tween method types become visually apparent. Methods that align more with the destruction-based conceptual model degrade concept generation continuously, In contrast, methods that align with the guidance-based conceptual model interfere with the conditional guidance process, producing more diverse images.
3.6 Summary
Across four probes, distinct patterns emerged. Methods such GA, Task Vectors, STEREO, and RECE, appear robust to text-based attacks like Textual Inversion and UnlearnDiffAtk (Sec. 3.T). Yet Task Vectors and RECE resurfaced the erased concept under inpainting and ciffusiion-complttion probes (Sec, 3.2). Noise-based probing further showed that concepts erased by UCE, ESD-x, and ESD-u could be recovered with minor stochastic perturbations: suggesting that these models still encode the concept but weakly guide away from it (Sec. 3.3). Classifier dlasidfier-uiided probing revealed even stronger residual traces: many models, including STEREO, could regenerate erased concepts at accuracies rivaling or exceeding Textual Inversion (Sec. 3.4.. Finally, dynamic tracing exposed
differing erasure dynamics, where GA and Task Vectors gradually degrade the concept, while ESD-x and ESD-u produce abrupt, unstable alternatives (Sec. 3.5).
Together, these findings indicate that most current crasure methods operate through guidance- based avoidance rather than true destruction of underlying representations, underscoring the need for multi-perspective evaluation to assess what "erasure" truly means in diffusion models.
Related Works
Concept erasure methods for text-to-image models. Recently, various techniques have been in- troduced to prevent generative models from producing images of unwanted concepts. Some work 16] propose modifying the inference process to steer outputs away from unwanted con- cepts. Other methods utilize classifiers to adjust the generated results. However, since inference- guided approaches can be circumvented with sufficient access to model parameters [24), subsequent research has focused on directly updating the model weights. Pham et al. [19 apply task vectors

---

to shift the model towards weight space that forgets the unwanted concepts. Heng and Soh [3 utilize continual learning techniques to erase targeted concepts. Gandikota et al. g8] fine-tune the model to minimize the likelihood of generating the desirable concepts. Gandikota et al. [00] propose a closed-form expression of the weights of an erased model. Gong et al. [[]] used a closed-form
solution to find target embeddings of a concept which are used to update the cross-attention layers accordingly. Zhang et al. [31] suggest cross-attention re-steering to update the cross-attention maps in the UNet model of Stable Diffusion to erase concepts.
Attacks against concept erasure methods. While concept erasure methods effectively prevent un- desirable generations when the concept is explicitly mentioned in the prompt (e.g.. "a painting in the style of Picasso"), recent studies have demonstrated that adversarial inputs can bypass most of these defenses. In a white-box setting, Pham et al. [8]] leveraged textual inversion to learn word embed- dings capable of reintroducing so-called erased concepts. Similarly, Rusanovsky et al. (2]] applied the same technique to learn latent seeds that reconstruct the removed concepts. Other research has focused on directly crafting hard prompts that evade concept erasure mechanisms.
29 32
Internal representations in diffusion models. Recent work has revealed that diffusion models en- code semantic information in structured and interpretable ways. For instance, Gandikota al. [9] demonstrated that semantic directions within the model can be effectively captured using low-rank adaptors, enabling precise continuous control. Building on this understanding. Dravid et al. [S] showed that semantic representations are localized within specific subspaces of the model's cross- attention weights. Further investigations into the architectural components of diffusion models have yielded important insights. Liu et al. [17]. Surkov et al. (27] discovered that specific concepts can be modified by targeting sparse sets of neurons. Through the application of Sparse Autoencoders (SAEs). Toker et al. (28) leveraged the UNet as an analytical tool to probe text encoder repre- sentations by studying how different internal representations influence the final generated outputs. Through our holistic evaluation framework, we analyze how different erasure methods distinctly affect concept representations.
Limitations
Causality and control in concept erasure. In many cases, even the expectations for an ideal con- cept erasure algorithm remain unclear. For example, when attempting to erase an art style like Van Gogh's, s, should we also remove related styles, such as Edvard Munch's? This is particularly tricky when causality is involved (e.g., should erasing 'Van Gogh' cause the erasing of 'Edvard Munch' but not vice versa?). In any case, achieving this level of control is still beyond the capabilities of current methods. Nevertheless, our findings offer some guidance: destruction-basee removal tends to impact related concepts more significantly than guidance-based avoidance.
Evaluating other concepts. Our study covers 13 concepts, 10 objects and 3 art styles. However, other concepts may include verbs, relationships, abstract ideas (e.g., 'violence'). Studying such concepts is beyond the scope of this work.
Discovery of existing knowledge vs. invoking it. In optimization- based probing techniques, there an inherent danger that the discovered knowledge does not originate from the original model, but rather to the optimization process [18). Namely, it could be that an extensive enough optimization- based probe (such as shown in See 3.4 may be able to induce generation of a concept the model did not even encounter during training. Careful consideration of this possibility is required, and may depend on the exact purpose of the erasure (e.g., safety, intellectual property law, or privacy).
Conclusion
In this paper, we propose suite of independent probing techniques to uncover traces of supposedly crased knowledge in diffusion models. Our evaluation reveals that knowledge undetectable through one technique can often be recovered through others. Surprisingly, probes that require less supervi- sion sometimes prove more effective than their more complex counterparts. Our study is motivated by the suspicion that many existing methods merely redirect generation away from target concepts rather than thoroughly erasing them, whether explicitly or implicitly. We hope our categorization of guidance- based versus destruction based mechanisms will guide future research into understanding how crasure fundamentally alters a model's 's internal representations and generative dynamics.
10

---

Acknowledgements
RG and DB are supported by Open Philanthropy and NSF grant #2403304
NC was partially supported by the Israeli Data Science Scholarship for Outstanding Postdoctoral Fellows (VATAT).
We thank the anonymous NeurlPS reviewers for their valuable comments and suggestions that have substantially improved this manuseript.
References
[1] Koren Abitbul and Yehuda Dar. How much training data is memorized in overparameterized autoen- coders? an inverse problem perspective on memorization evaluation. Joint European Conference on Machine Learning and Knowledge Discovery in Databases, pages 321-339. Springer, 2024.
[2] AUTOMATICI111. Negative prompt, 2022.
[3] Zhi-Yi Chin, Chich-Ming Jiang, Ching-Chun Huang, Pin-Yu Chen, and Wei-Chen Chiu. Prompt- ing4debugging: Red Redd-eeamigg text-to- text-to-image diffusion models by finding problematic prompts. In Forty- first International Conference Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024. OpenReview.net, 2024.
[4] Prafulla Dhariwal and Alex Nichol. Diffusion models beat gans image synthesis. In Advances Neural Information Processing Systems, pages 8780-8794 8794,, 2021. NeurIPS 2021.
[5] Amil Dravid, Yossi Gandelsman, Kuan-Chich Wang. Rameen Abdal, Gordon Wetzstein, Alexei Efros, and Kfir Aberman. Interpreting the weight space of customized diffusion models. arXiv preprint arXiv:2406. 09413, 2024.
[6] Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit H Bermano, Gal Chechik, and Daniel Cohen- Or. An image is worth word: Personalizing text-to-image generation using textual inversion. arXiv preprint arx::22008.0 016118 2022.
[7] Rohit Gandikota and David Bau. Distilling diversity and control in diffusion models. arXiv preprint arXiv:2503. 10637, 2025.
[8] Rohit Gandikota, Joanna Materzynska, Jaden Kaotta-Kaufman, and David Bau. Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 2426-2436, 2023.
[9] Rohit Gandikota, Joanna Materzyúska, Tingrui Zhou, Antonio Torralba, and David Bau. Concept sliders: Lora adaptors for precise control in diffusion models. In European Conference on Computer Vision, pages 172-188. Springer, 2024.
[10] Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzyáska, and David Bau. Unified concept editing in diffusion models. Proceedings of IEEF/CVF Winter Conference on Applications of Computer Vision, pages 51 5111-5120, 2024.
[11] Chao Gong, Kai Chen, Zhipeng Wei, Jingjing Chen, and Yu-Gang Jiang. Reliable and efficient concept erasure of text-to-image diffusion models. In European Conference on Computer Vision, 2024.
[12] Chao Gong, Kai Chen, Zhipeng Wei, Jingjing Chen, and Yu-Gang Jiang. Reliable and efficient concept erasure of text-to-image diffusion models. arXiv preprint 200.::4407..238.. 2024.
[13] Alvin Heng and Harold Soh. Selective amnesia: A continual learning approach to forgetting in deep generative models. In Advances Neural Information Processing Systems, 2023.
[14] Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. Clipscore: A reference-free evaluation metric for image captioning. arXiv preprint arXiv:2 (0o.2200.087/ 18, 2021.
[15] Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Han- naneh Hajishirzi, and Ali Farhadi. Editing models with task arithmetic. arXiv preprint arXiv:2212.04088 2022.
[16] Anubhav Jain, Yuya Kobayashi, Takashi Shibuya, Yuhta Takida, Nasir D. Memon, Julian Togelius, and Yuki Mitsufuji. Trasce: Trajectory steering for concept erasure. CoRR, Abs/2412.07658, 2024.
11

---

[17] Zhiheng Liu, Ruili Feng, Kai Zhu, Yifei Zhang, Kecheng Zheng, Yu Liu, Deli Zhao, Jingren Zhou, and Yang Cao. Cones: Concept neurons in diffusion models for customized generation. arXiv preprint arXiv:2303.0553 055125 2023.
[18] Minh Pham, Kelly O Marshall, Niv Cohen, Govind Mittal, and Chinmay Hegde. Circumventing cept erasure methods for temaaee generative models. The Twelfth International Conference on Learning Representations, 2023.
[19] Minh Pham, Kelly O Marshall, Chinmay Hegde, and Niv Cohen. Robust concept erasure using task vectors. arXiv preprint arXiv:2404.0363) 2024.
[20] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High-resolution image synthesis with latent diffuusin models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 10684-10695, 2022.
[21]
Matan Rusanovsky, Shimon Malnick, Amir Jevnisek, Ohad Fried, and Shai Avidan. Memories of forgot- ten concepts. arXiv preprint arXiv:2412.00772, 2024.
[22] Patrick Schramowski, Manuel Brack, Bjöm Deiseroth, and Kristian Kersting. Safe latent diffusiio: Mit- igating inappropriate degeneration in diffusion models. In Conference on Computer Vision and Pattern Recognition, 2023.
[23] Aakash Sen Sharma. Niladri Sarkar, Vikram Chundawat, Ankur A. Mali, and Murari Mandal. Unlearning or concealment? critical analysis and evaluation metries for unlcamnin in diffusion models. arXiv preprint arXiv:2502. 2002:228...0.8.. 2025.
[24] SmithMano. Tutorial: How remove the safety filter in seconds, 2022.
[25] Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Conference Learning Representations, 2021.
[26] Koushik Srivatsan, Fahad Shamshad, Muzammal Naseer. Vishal M Patel. and Karthik Nandakumar. Stereo: A two-stage framework for adversarially robust concept erasing from text-to-image diffusion models. arXiv preprint urXiv:2408. 16807, 2024.
[27] Viacheslav Surkov, Chris Wendler, Mikhail Terekhov, Justin Deschenaux. Robert West, and Caglar Gul- cehre. Unpacking sdxl turbo: Interpreting text-to-image models with sparse autoencoders. arXiv preprint arXiv:2410.22366, 2024.
[28] Michael Toker, Hadas Orgad, Mor Ventura, Dana Arad, and Yonatan Belinkov. Diffusion lens: Interpret- ing text encoders in text-to-inn -ot-to--mmae pipelines. arXiv preprint arXiv:2403.05846, 2024.
[29] Yu-Lin Tsai, Chia- Yi Hsu. Chulin Xie, Chih-Hsun Lin. Jia- You Chen, Pin- Chen, Chia-Mu Yu, and Chun Ying Huang. Ring-a-bell how reliable are concept removal methods for difffusion models? arXiv preprint ar 10012, 2023.
[30] Jachong Yoon, Shoubin Yu, Vaidehi Patil, Huaxiu Yao, and Mohit Bansal. SAFREE: training free and adaptive guard for safe text-to-image image and video generation. CoRR, abs/2410. 2024.
[31] Eric J. Zhang, Kai Wang, Xinggian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not: Learning to forget in text-to-image diffusion models. CoRR, abs/2303. 175911, 2023.
[32] Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yihua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. To generate not? driven unlearned diffrusion models are still easy to generate unsafe images... for now, In European Conference on Computer Vision, pages 385-403 Springer, 2025.
12

---

A Broader Impact
14
Training Free Inference Time Nosse Probe
14
B.1 Noising Probe in Practice
14
Erasing and Evaluation Implementation Details
14
Concepts
14
Experiment Results Reproducibility
14
Evaluation Protoco
15
C.3.1
CLIP Evaluation
15
C,3,2
Classifier Evaluation for Object Concepts
15
C.3.3
Side-effects on Unrelated Concepts
15
C.4
Erasure Methods
15
C.4.1
Gradient Ascent (GA)
16
C.4.2
Erased Stable Diffusion (ESD-x x & ESD-u)
16
C.4.3
Unified Concept Editing (UCE)
16
C.4.4
Task Vector (TV)
16
Probing Methods and Additional Results
16
Textual Inversion
16
D.2
UnlearnDilIAA
16
D.3
Inference- Time Noising Probe
16
D.4
Inpainting
17
D.5
Steered Latent Probing: Classilier Guidance Implementation
17
D.5.1
Datasel Construction)
17
D.5.2
Lalent Encoding and Caching
17
D.5.3
Timestep-Aware Latent Classifier
17
D.5.4
Training Procedure
17
D.5.5
Inference- Time Steering (Guidance)
18
D.6
Dynamie Concept Tracing
18
Full Results with Standard Deviations
18
13

---

A Broader Impact
Our work aims to improve the reliability and transparency of concept erasure in diffusion models, a task with growing importance as generative models are deployed in real-world settings. Effective erasure can help pre- vent the generation of harmful, private, copyrighted content, but also introduces risks, such as the potential misuse of these methods to suppress culturally or politically significant concepts. By providing a compre- hensive evaluation framework, we offer tools to better understand the trade-offs involved in crasure methods, particularly between robustness and the preservation of unrelated capabilities. We hope this encourages more responsible and assessment of crasure techniques, while recognizing that such methods not complete solution and must be applied with care and oversight.
B Training Free Inference Time Noise-Based Probe
Song et al. (25] introduced Denoising Diffusion Implicit Models (DDIM), which presented deterministic generative process defined by the equation:
Cee (ai)
Tt-1 vai-
ac-1 - of (4) (a.)
(5)
Vau
mindom noise
pointing z2."
observe that random noise term acts a brownian motion component, driving stochastic sample gener- ation when d: >> O. This insight motivates our approach: by controlling the magnitude of this brownian motion, we can systematically explore broader latent space of the diffusion model. We modify the DDIM formulation by introducing scaling factor additional random noise component:
2t-1 Vau-1
vI Cuie (IEA)
(+)
+
1 ai 7. of (t)(z)) + n.c oee
(6)
Val
injection
We take the absolute value of the "direction pointing xr" term because scaling 1) >> 1 root to receive negative argument, which breaks the generative process. To avoid this failure mode while still injecting increased stochasticity, we apply the absolute value inside the square root. This allows us to safely explore values of 1) >> 1, cnabling stronger noise injection than what standard DDIM or DDPM configurations permit. We leverage this controlled over-noising training-free Noise-Based probe, allowing the model to access otherwise unreachable latent regions that may contain residual concept information.
the square
B.1 Noising Probe in Practice
The theoretical argument above suggests that injecting noise into the diffusion process can enable the recovery of erased concepts. Standard samplers such as DDPM already introduce stochasticity, but their noise levels typically fixed and moderate. To evaluate the practical effect of noising attack, we compare three sampling strategies: (1) DDIM1, the deterministic DDIM sampler with v = 1; (2) DDPM, the stochastic ancestral sampler; and (3) Prise-Baaed, our proposed sampling strategy that explicitly increases the noise level beyond standard settings (c.g.. >> 1). DDIM with 7 = 0 is the standard deterministic scheduler for the models, which has been evaluated to produce the target concepts close to 0% of the time.
Remark.
Table reports CLIP similarity scores and top-1 classification accuracy across 13 crased concepts for threc crasure methods: esdu, esdx, and uce. Our noising approach consistently improves both CLIP alignment and classification accuracy, demonstrating that inference-time noise injection can serve as a practical, training-free mechanism for concept recovery. See Section D,3 for details on noise scales and sampling configurations.
C
Erasing and Evaluation Implementation Details
C.1 Concepts
We consider a set of 10 object concepts: English Springer Spaniel, airliner, garbage truck, parachute, cassette player, chainsaw, tench, French horn, golf ball, and church; alongside 3 distinct art styles: Van Gogh, Picasso, and Andy Warhol. This selection allows evaluate the impact of concept erasure across both tangible objects and artistic styles, ensuring diverse range of visual and semantic attributes in our analysis.
C.2 Experiment Results Reproducibility
To train all the models, run the entire evaluation suite, and create the CLIP and classificatio metrics, we used two NVIDIA A6000 GPUs. This mainly involved generating the probingimages (for validating erasure, assessing
14

---

esdu
esdx
CLIP Score (1)
DDIMI
25.80
26.34
26.81
DDPM
25.80
26.35
26.81
Noised-Basce
27.99
30.56
30.65
Top-1 Accuracy (%) (t)
DDIMI
13.77
20.62
18.31
DDPM
13.00
20.38
16.85
Noised-Based
27.70
30.70
21.90
Table 5: Average CLIP scores and Top-1 classification accuracy for each method and sampling scheduler. The Noised-Based probe significantly boosts concept recovery performance.
robustness via attacks, and checking interference with unrelated concepts), and evaluating the performance using CLIP similarity and classification accuracy.
C.3 Evaluation Protocol
C.3.1 CLIP Evaluation
All similarity assessments were performed using CLIP ViT (openaš/cliip-vit-besss (att-baas---tchh2)) For an object, such garbage truck, we compared the output image to the generation prompt, i.c. "a picture of a garbage truck".
C.3.2 Classifier Evaluation for Object Concepts
To assess whether erased concepts remain recognizable generated images, we perform classification using ResNet-50 model pretrained on the Imagenette dataset, simplified subset of ImageNet. Each generated image processed by the classifier, and the top-5 predicted class labels are extracted based on softmax scores.
We consider prediction correct if the concept name (e.g., cassette, (aatte__paaer) matches the top-1 prediction (Top-1 Accuracy), or appears anywhere in the top-5 predictions (Top-5 Accuracy). For each match, we also record the classifier's confidence score as the Top-1 Top-5 Score.
Classification results aggregated across all object concepts (excluding artistic styles), and report the following metrics per method and evaluation setting:
Top-1 Accuracy: Percentage of images where the correct label is the highest scoring prediction.
Top-5 Accuracy: Percentage of images where correct label appears within top-5 predictions.
Top-1 Top-5 Scores: Average softmax for correct labels when they appear in the top-1 top-5.
This evaluation provides quantitative measure of whether crased concepts can still be semantically identified using an external classifier trained real-worle object categories. For the main paper, mainly focus Top-1 Accuracy
For artist classification, we used CLIP-hased similarity between generated images and artist-specficc prompts as proxy for classification, following prior work on zero-shot image-text alignment.
C.3.3 Side-effects on Unrelated Concepts
To evaluate whether concept crasure negatively impacts unrelated generations, we assess each model's 's ability to generate images for concepts that were not erased. Specifically, for each of the 13 erased concepts, consider the remaining 12 as control classes. For each model, we generate 10 images per control class, resulting in 120 control task images.
similarity scores and classification accuracies these images to quantify the extent to which erasure methods affect generalization and performance on unrelated concepts. Please see Figure & for examples.
then compute
C.4 Erasure Methods
To evaluate the impact of different concept erasure techniques, we implemented several existing methods and trained models under controlled settings. Below, we detail the exact configurations for each approach:
15

---

1.4
GA
UCE
ESDxs
ESDa
STEREO
Andi
Ooghh" Franal
(tplo Pozsao
Figure 8: We show the undesirable effects of the erasure methods when erased "Van Gogh" concept on unerased concepts like "Church" and "Picasso". We find that Gradient Ascent and STEREO have the most interference with unrelated concept.
C.4.1 Gradient Ascent (GA)
We implement the Gradient Ascent (GA) method by negating the standard training loss used in Stable Diffusion, effectively encouraging the model increase the likelihood of generating the larget concept. The training data comprises 500 diverse images per concept, generated using the original model along with their associated text prompts. For the English Springer Spaniel and Garbage Truck concepts, we reduced the number of fine tuning steps to 10, while using 60 steps for all other concepts. To prevent degradation of the model's Is general utility, known issue when applying GA over extended training, we adopt conservative training configuration: batch size of 5, gradient accumulation steps of 4, and learning rate of 10
C.4.2 Erased Stable Diffusion (ESD-x ESD-u)
We fine-tuned for 200 steps using learning of 10-5
C.4.3 Unified Concept Editing (UCE)
We fine-tuned for 200 steps with an empty guiding concept and an crase scale of
C.4.4 Task Vector (TV)
To get the fine-tuned model computing task vectors, we fine-tuned each model on 500 images 200 steps, using a learning rate x 10-5, We used batch size of 4 and gradient accumulation step of 4. For crasure, we set the editing strength 1.75.
D Probing Methods and Additional Results
To assess the resilience of crasure methods against adversarial strategies, we conducted various attack experi- ments using dataset of 100 prompts spanning 13 concepts (10 objects, 3 styles), each evaluated using unique seeds.
D.1
Textual Inversion
Training involved 100 images, optimized for 3000 steps using learning rate of 5 10-4
D.2 Difear
The model was trained using learning rate of 0.01 and weight decay of 0.1, with the classifier parameter set K 3. ImageNet was used the classifier for object-based erasures, while custom classifier from the UnlearnDiffAtk repository was used artist styles. Due to computational cost, UnlearnDiffAAtk was evaluated on 30 prompts per concept, with 40 samples per experiment, where each sample was generated through 40 optimization steps.
D.3 Inference- Time Noising Probe
We searched over an evenly spaced set of 6 y values between 1.0 and L.85; [1.0, 1.17, 1.34, 1,51, 1.68, 1.85). These bounds were chosen based on qualitative observations: values above 1.85 produced overly noisy images, while those below 0.95 resulted in blurry object generation. For each n, scaled the additional random
16

---

noise added each denoising step by factor of 1.00, 1.02. 1.03, or 1.04. A full grid search across these combinations yielded 24 samples per prompt per experiment. The CLIP model then selected the image with the highest similarity score as the representative probing instance.
D.4 Inpainting
The inpainting pipeline was based Stable Diffusion 1.5 and implemented via Hugging Face's www.eiifffssioonnaannniiiiii
Base images were 512x512 pixels and were masked with a 225x225 white box the center. Source images were generated using Stable Diffusion 1.4, CLIP scores were computed only on the masked area to prevent artificially inflated similarity scores.
D.5 Steered I Latent Probing: Classifier Guidance Implementation
We implement steering latent probing training lightweight, timestep-awart classifier in the Stable Diffusion latent space and injecting its gradient during sampling to steer trajectories toward residual concept regions.
D.5.1
Dataset Construction
We construct binary datasets per concept from ImageNet- kk as follows:
Positives:
all samples belonging to the target ImageNet class (resolved via the label name lookup in the HF metadata).
Negatives: diverse pool sampled from all other classes (default: Tlnyy = 5000), oversampled initially to ensure diversity, then downsampled to the requested size.
Binary label: add label_bing column (1 for positives, 0 for negatives), and save each concept subset to disk HuggingFace Dataset.
We apply standard SD image preprocessing (resize to 512 512, normalization to [-1, The split is 90% train 10% validation.
D.5.2 Latent Encoding and Caching
Images mapped to Stable Diffusion latents using the SD v1.4 VAE (AutoencoderKL)) sampling from the posterior and scaling by 0.18215, yielding latents of shape (4, 64, 64). We precompute and cache latents for both train and validation splits to avoid repeated VAE passes during classifier training.
D.5.3 Timestep-Aware Latent Classifier
Let ex1xx1x61 denote latent and E (O.... 1- diffusion timestep. encode using the scheduler's cumulative noise level ā,:
e(t) = [ā,, - o.] R??.
The classifier (a, t) is a small MLP with two streams:
Latent stream: flatten z and project to 1024 dims.
Timestep stream: project e(t) to 1024 dims.
We sum the two 1024-d embeddings and pass through: SiLU, Dro)out(O.3), Linear(1024-$122, SiLU, Dropout(0.3), Linear(512-11) yielding logit. This architecture is intentionally small to avoid overfitting and keep gradients stable during guidance.
D.5.4 Training Procedure
We train with AdamW (Ir 1 10 weight decay 10 10) batch size 8, gradient clipping at 1.0, for 10 epochs by default. The loss is BCEWithLogits with plsitive-class weight
#neg
Upon
#
computed from the subset counter class imbalance.
To improve robustness noise levels, each mini-batch is augmented with À noisy views per sample (default k= 7). We draw timesteps power-law that favors noisier latents:
i (Uniform(O, 17" (T (T-1), 1). 7 3.0,
and form noisy latents with the scheduler's forward operator. Validation averages logits over independently sampled timesteps. After training for 70 epochs, we pick the checkpoint with the lowest validation loss.
17

---

D.5.5 Inference-Tinne Time Steering (Guidance)
During sampling. we run the standard classifier-free guidance (CFG) pass to obtain Edg and then inject the latent-classifier gradient. At each timestep f
1. Compute Eaiz using CFG with guidance scale 7.5.
Enable gradients on current latent xy and compute the BCE loss with target label I:
(CCEWitLLoogis((f(( (), 1).
3. Backpropagate obtain gt. V., Le, scale sai (the classifier guidance strength), and rescale by the current noise level:
== Edg vI de Sat Jc.
Step the scheduler with using DDIM sampler then continue.
The classifier gradient acts as a steering force that nudges the diffusion trajectory toward regions where the classifier predicts high probability for the target concept. Since we're probing for residual concept knowledge in an erased model, successful steering reveals that the model still retains information ahout the supposedly erased concept.
This steering follows the principle of classifier guidance in diffusion models. To sample from conditional distribution pa (x. c") ). Bayes' rule tells us we can decompose score as:
Xx, Pog (x: c²) Xx, Po + Vx, logPo(c" xx)
The first term the unconditional diffusion score, and the second term (approximated by our classifier gradient) steers the sampling toward the concept c". The guidance scale 8ar controls how strongly we condition on the concept, effectively amplifying any residual concept knowledge that remains after erasure.
D.6 Dynamic Concept Tracing
We quantitatively analyze how concept representations evolve during the erasure process by tracking the trajec- tories of generated images in CLIP embedding space. For cach crasure method and target concept, we generate 25 images at varying erasure strengths and compute the centroid of their CLIIP embeddings. This allows us to measure how far the generated concepts drift from their original representations as crasure intensity increases.
Figure revells distinct patterns between erasure methods. Gradient Ascent and Task Vector exhibit approxi- mately Tinear trajectories, progressively pushing concept representations away from their original locations in embedding space. In contrast, ESD-x and ESD-u demonstrate more abrupt displacement. This pattern hints that their approach redirects generation toward unconditional outputs rather than fundamentally altering the concept representation itself.
GA Centroud Deviation Over Time
ESDxx Centroid Deviation Over Time
ESD Centroid Deviation Over Time
TV Centroid Deciation Over Tine
Bradidee Decareoi CLUP Sparn
Cood ENCAAO IN CLUI Space
CLI Space
100
Gradiest Auoest Staps
ES5 Stops
ESD
Figure 9: Trajectories of concept representations during erasure in CLIP embedding space. The x- axis shows erasure strength, while the y-axis measures the Euclidean distance between the centroid (mean) of all generated samples and the original concept embedding (computed from 25 samples per concept). Shaded regions indicate 95% confidence intervals. The GA and TV methods show more consistent degradation patterns than ESD-x and ESD-u.
E Full Results with Standard Deviations
We include here the full guantitative results with standard deviations across runs, complementing Tables 2, and 3 from the main paper. These tables report the mean and standard deviation for both CLIP similarity scores and classification accuracies across multiple erasure evaluation settings. Including standard deviation helps illustrate the consistency and robustness of each erasure method under different probing strategies.
18

---

Eval Metric
Base
GA
UCE
ESD-x
ESD-u
TaskVee
STEREO
RECE
Erased Concepts (1)
CLIP
24.3 +
22.4 21.1 #411
3.4
23.1 3.0
19.6 2.3
21.2 31.2+400 4.0
Text Inversion (1)
CLIP
22.7
30.7 = 2.0
30.6 2.4
25.1 2..0
2.6
2.9
29.2 +
UnlearnDiffAtk
CLIP
26.0 + 2.2
28.3 + 3.2
28.7 2.2
27.8 2.8
27.1 1.7
26.1 + 2.8
27.9 + 2.3
Unrelated Concepts (1)
CLIP
28.8 + 2,8
31.2 + 2.3
30.8 2.5
30.7 + 3.3
29.4 2.6
29.0 2 3.0
30.5 2.7
Inpainting (4)
CLIP
29.5 = 2.2
24.8 + 2.4
26.9 + 3.3
26.8 #.1
23.9 3.1
25.9 = 2.6
22.7 = 3.0
26.3 2.7
Diffusion Completion t = 5 (L)
CLIP
30.2 = 2.1 24.0 + 2.4
27.7 2.8
27.2 + 3.1
26.9 2.9
23.8 + 2.4
23,9 2.7
28.8 + 2.5
Diffusion Completion t = 10 (L) CLIP
30.2 = 2.1 24.5 + 2,3 29.6 2.3
28.7 + 2.9
278
24.9 2.3
27.8 2.6
28.8 + 2.5
Table CLIP scores (mean + std) across concept erasure methods. Lower scores (4) indicate better erasure of the target concept, while higher scores (f) reflect stronger retention of unrelated concepts. Rows cover adversarial and in-context evaluations including inpainting and diffusion completion at denoising steps
5 and t 10.
Eval Metric
Base
UCE
ESD-x
ESD-u
Task
STEREO
RECE
Erased Concepts (4) Acc. (%)
0.6 1 0.48
4.4 1.1
3.6
1.0 + 0.69
2.2 1.0 0.0 = 0.00
4.0 1.2
Inversion (4)
Acc. (%)
0.6 + 0.59
71.2 2.3
65.9 + 2.9
31.8 + 3.6
6.2 = 1.8
6.3
58.2 +.1
UnlearnDiflAtk
Acc. (%)
6.5 1.5
26.8 + 2.8
21.0 2.6 16.6 2.3
10.3 2.1
1.7110
7.2 1.7
Unrelated Concepts (1)
Acc. (%)
52.2 2.7
75.0 = 1.9
71.3 + 2.2
2.4
60.4 = 2.6
52.8
71.7 2.1
Inpainting (L)
Acc. (%)
77.7 1.5 2.4
69.1 1.8
69.1 # 1.9
68.5 1.7
66.8 1.6
6.08
68.2 1.8
Diffusion Completion (L)
Acc. (%)
78.0 1.4 1.1 # 0.58
4.7
37.8
3.2
2.4 0.94
3.2 1.2
36.5 3.3
Diffusion Completion t (L) 78.0 3.2 1.1 62.1 2.3
Acc. (%)
2.7
36.9
6.1
21.2 + 2.2
4..4
Table 7: Classification accuracy (%, mean + std) across seven concept erasure methods and the original Stable Diffusion model (Base). Lower values (4) on erased concepts, textual inversion, UnlearnDiffAtk inpainting, and diffusion completion indicate more effective removal of the target concept. Higher values (f) on unrelated concepts reflect successful preservation of general genera- tion capabilities.
NeurIPS Paper Checklist
Claims
Question: Do the main claims made the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: See Sec 3
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
19

---

The abstract and/or introduction should clearly state the claims made, including the contribu- tions made in the paper and important assumptions and limitations. A No NA answer this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can he expected to generalize to other setrings.
is fine to include aspirational goals as motivation long clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: See Sec 5
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are discussed in the paper.
The authors are encouraged create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to viola- tions of these assumptions (e.g., independence assumptions, noiseless settings, model well- specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
scope the claims made, e.g., the approach was only tested on a few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should he articulated.
The authors should reflect
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images taken in low lighting. Or speech-to terccttt-eexttttt system might not be used reliably provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
applicable, the authors should discuss possible limitations their approach to address prob- lems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't I acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparcncy play important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a com- plete (and correct) proof?
Answer: [NA]
Justification: NA.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proof's in the paper should be numbered and cross-referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed reproduce the main experimen- results of the paper to extent that affects the main claims and/or conclusions the paper (regardless whether code and data are provided or not)?
Question:
Answer: [Yes]
20

---

Justification: See App C
Guidelines:
The answer NA means that the paper does not include experiments. If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible important, regardless of whether the code and data are provided or not.
the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibilityy can accomplished various ways. For ex- ample. if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. general. releasing code and data often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submissions provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make clear how reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contrihution is a new model (e.g., a large language model), then there should either he way to access this model for reproducing the results way reproduce the model (e.g.. with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that repraduciiility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, may be that access the model is limited in some way (e.g.. registered users), but should be possible for other researchers have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, described in supplemental material?
Answer: [Yes]
Justification:
See supplementary materials.
Guidelines:
The answer NA means that paper does include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (httpa://nips.. cc/publcc/ guides/Codeeubni ssioooolccy for more details.
While we encourage the release of code and data, we understand that this might be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g.. for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to repro- duce the results. See the NeurIPS code and data submission guidelines lhttps://nipp cc/ public/ Segpiidde/oooeeuubn ssionPoiccyll//c for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
6. Experimental sefting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
21

---

Answer: [Yes]
Justification:
Yes. See App C and code.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is
necessary appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, supplemental material.
Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate infor- mation about the statistical significance of the experiments?
Answer: [Yss]
Standard deviations are reported in the supplementary material.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" the results are accompanied by error bars, confidence inter- vals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the emor bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error hars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report I-sigma error bars, but one should state it. The authors should preferably report 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is verified.
For asymmetric distributions, the authors should be careful symmetric hars that would yield results that are of range (c.g. negative rates).
show in tables figures
error bars reported in tables plots, The authors should explain in the text how they calculated and reference the corresponding figures or tables the text.
8. Experiments compute resources
Question: For each experiment, does the paper provide sufficient information on the computer re- sources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Answer: [Yes]
Justification: Please App
Guidelines:
The answer NA means that paper does not include experiments.
The paper should indicate the type compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required each of individual experimen- tal runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (c.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code of ethics
Question: Does research conducted in the paper conform, in every respect, with NeurIPS Code of Fihics https: http://wwwwwppppptetatatttttaaaa
Answer: [Yes]
Justification:
Yes.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
22

---

If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is special consideration due laws regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal im- pacts of the work performed?
Answer: [Yes]
Justification: See App
Guidelines:
The answer NA means that there is societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has societal impact why the paper does address socictal impact.
Examples of negative societal impacts include potential malicious unintended uses (c.g.. dis- information, generating fake profiles, surveillance), fairness considerations (e.g., deployment technologies that could make decisions that unfairly impact specific groups), privacy consid- erations, and security considerations.
The conference expects that many papers will be foundational research and not tied to par- ticular applications, let alone deployments. However, there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used generate deepfakes for disinformation. On the other hand, is not needed to point out that generic algorithm optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strate- gies (e.g.. gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, im- proving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, scraped datasets)?
Question:
Answer: [NA]
We do not release novel pretrained language models, image generators. or scraped datasets.
Justification:
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification:
See supplementary material.
Guidelines:
The answer NA means that paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, possible, include URL.
23

---

The name of the license (e.g.. CC-BY 4.0) should be included for each asset.
For scraped data from particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, wwpppsapphhhseoooo thcode. cow/ datasett has curated licenses for some datasets. Their licensing guide can help determine the license a dataset.
For existing datasets that re-packaged, both the original license and the license of the derived asset (if changed) should provided.
this information not available online, the authors encouraged reach out the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and the documentation provided alongside the assets?
Answer: [NA]
Justification: Not applicable.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model as part of their submis- sions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL include an anonymized zip file.
14. Crowdsourcing and research with human subjects
For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, well as details about compensation (if any)?
Question:
Answer: [NA]
Justification: Not applicable.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to subjects, and whether Institutional Review Board (IRB) approvals (or an equiv- alent approval/review based on the requirements of your country or institution) were obtained?
Question:
Answer: [NA]
Justification: Not applicable.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained TRB approval, you should clearly state this the paper.
We recognize that the procedures for this may vary significantly between institutions and lo- cations, and we expect authors to adhere the NeurIPS Code of Ethies and the guidelines for their institution.
initial submissions, not include any information that would break anonymity (if applica- ble), such as the institution conducting the review.
16. Declaration of LLM usage

---

Question: Does the paper describe the usage of LLMs if it important, original, non-standard component of the methods in this research? Note that the LLM is used only for writing, editing, or formatting purposes does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification: An LLM is used only for editorial purposes.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy should or should not be described.
for what
25


Reviews:
[{"review_id": "YFHJLYKFjC", "reviewer": "Reviewer_jc67", "summary": "This paper investigates whether concept erasure *actually* removes the latent concepts or merely suppress their likelihood of generation through gradient redirection during diffusion. This is formalized as (1) guidance-based avoidance and  (2) destruction-based removal. To answer the four RQs, the authors compile an evaluation suite comprising optimization-based probing (textual inversion, adversarial attacks), in-context probing (inpainting, diffusion completion), training-free trajectory probing (noise injection), and dynamic concept tracing during erasure. This is applied to seven seven methods and 13 concepts — 10 objects and 3 artistic  styles — highlighting that these methods are usually robust on one of the defined types of erasure but struggle on the other.", "questions": "1. Method Categorization. How do you determine ig a method is guidance- or destruction-based a priori, rather than post-hoc based on empirical performance? Could you provide more principled criteria or theoretical analysis to validate this categorization?\n\n2. Scalability to Harmful Content: How would your framework perform on concepts that are often used as motivation for the existance of concept erasure (e.g., explicit content or copyrighted material)?", "limitations": "Yes, the authors adequately address limitations in Section 5, acknowledging the restricted concept scope, causality issues in concept erasure, and the potential need for additional conceptual models. The broader impact section (app A) appropriately discusses both positive applications and potential misuse concerns. However, the authors could strengthen this by discussing the computational overhead of their evaluation framework and potential limitations in scalability to production systems.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. New Conceptual Framework. The distinction between guidance-based avoidance and destruction-based remova is a really valuable theoretical grounding for the community and future work in this direction.\n2. Comprehensive Evaluation Suite.\n3. Practical Insights. The finding that methods, which may appear quite robust under adversarial attacks can still be vulnerable to context-based probes (tab 2, fig 3), has important implications for deployment of erasing methods.\nWeaknesses:\n1. Limited Scope of Concepts. The evals cover 13 concepts (10 objects and 3 art styles), which may not generalize to some more complex concepts or larger domains of objects. The authors acknowledge this limitation (Section 5, lines 267-269). Though, it’s not clear to me why, instead of so many single objects, the authors did not choose to explore this.\n2. Validation of the Theoretical Framework: While the two modes of erasure proposed here seem intuitive, the paper would benefit from more support of this categorization. The assignment of methods to categories appears somewhat post-hoc based on empirical performance rather than principled analysis of the underlying mechanisms.\n3. Trade-off Analysis. While the paper mentions the trade-off between erasure thoroughness and preservation of unrelated concepts (lines 45-46, 123-124), this aspect could, perhaps, benefit from a more quantitative analysis.\n4. Noise-Based Probing Limitations: The theoretical justification for the noise-based probe (app B) relies on some strong assumptions (partial latent retention and specific SDE formulations). The proof sketch appears limited to me compared to other probing methods (tab 3).\n5. Prior Work. The issues with existing concept erasure methods have been identified before, and I would hence suggest the following citations: https://arxiv.org/pdf/2502.13989v1 https://dl.acm.org/doi/10.1145/3635636.3664268 https://arxiv.org/abs/2502.14896", "was_revised": true, "final_justification": "As noted below, the vast majority of my concerns were fully resolved. One concern partially remained, but I felt like given the effort exhibited by the authors in the response, and technical rigor of the existing experiments, I am confident moving my rating to an Accept with the string recommendation for reframing the significance of some of the findings.", "rebuttal": "We thank the reviewer for acknowledging the value of the guidance-based avoidance and destruction-based removal concept erasing framework. As you point out, results emphasize the importance of testing erasure methods across multiple probing types.\n\n  **“Limited Scope of Concepts”, “Scalability to Harmful Content”**\n\nWe thank the reviewer for raising this point and agree that expanding to other concepts would strengthen our results. In the initial study, we deliberately chose a focused set to control for confounding factors such as prompt ambiguity, visual diversity, and domain shifts.\n\nTo assess the scalability of our framework to safety-relevant domains, we evaluated it on NSFW content, specifically nudity. We use 100 prompts from the I2P dataset and evaluate nudity scores using the NudeNet classifier.\nAs shown in the table below, our framework successfully captures differences in guidance vs destruction-based erasing behavior across the methods. Interestingly, the Noise-Based probe (Sec.3.3) was surprisingly effective at revealing residual NSFW features in erased models. For example, using this probe, ESD-u's classification rate increased from 23% to 79%. This reinforces the utility of our multi-probe evaluation in these settings as well. \n\n| | SD | UCE | ESD-U | RECE | STEREO | GA | TV |\n|---------------------------------|-------|-------|-------|-------|--------|-------|-------|\n| **Ground Truth** | | | | | | | |\n| Avg. Nudenet Score | 0.57 | 0.22 | 0.11 | **0.05** | 0.06 | 0.10 | 0.07 |\n| Classification (%) | 83.0 | 39.0 | 23.0 | **12.0** | 18.0 | 28.0 | 21.0 |\n| **Interference Probe** | | | | | | | |\n| Avg. CLIP Score | 31.20 | 29.66 | **30.50** | 29.97 | 28.61 | 27.23 | 29.92 |\n| Classification (%) | 95.2 | 72.0 | **76.0** | 75.2 | 65.0 | 45.0 | 70.0 |\n| **Textual Inversion** | | | | | | | |\n| Avg. Score | 0.81 | 0.73 | 0.75 | 0.69 | **0.61** | 0.72 | 0.65 |\n| Classification (%) | 99.8 | 87.4 | 88.1 | 75.2 | **28.5** | 29.0 | 54.0 |\n| **UDA** | | | | | | | |\n| Avg. Score | 0.70 | 0.66 | 0.71 | 0.60 | **0.55** | 0.69 | 0.61 |\n| Classification (%) | 95.5 | 74.3 | 62.0 | 69.1 | **41.0** | 44.3 | 57.5 |\n| **Inpainting** | | | | | | | |\n| Avg. Nudenet Score | 0.45 | 0.30 | 0.31 | 0.29 | **0.28** | 0.29 | 0.33 |\n| Classification (%) | 72.0 | 54.0 | 53.0 | 57.0 | **51.0** | 52.0 | 60.0 |\n| **Diffusion Completion (t=5)** | | | | | | | |\n| Avg. Score | 0.57 | 0.68 | 0.68 | 0.71 | 0.66 | **0.59** | 0.69 |\n| Classification (%) | 83.0 | 75.6 | 74.9 | 77.2 | 65.8 | **56.4** | 75.1 |\n| **Noise-Based Probe** | | | | | | | |\n| Avg. Score | 0.72 | 0.53 | **0.70** | 0.52 | **0.48** | 0.62 | 0.51 |\n| Classification (%) | 99.7 | 73.0 | **79.0** | 63.0 | **37.0** | 42.0 | 72.0 |\n\n\n\n**“more support of this categorization”**\n\nOur motivation behind guidance vs destruction categorization is based on the resultant distribution of the erased concept post erasure. With guidance based methods, the unlearning algorithm pushes the conditional probability $P(X | c)$, where $c$ is the erased concept, to another known distribution. For example, with UCE we can write the erased distribution $P(X | c*)$ where $c*$ is the anchor concept, which comes from the following loss function:\n\n$$\n\\mathcal{L}(W) = \\sum_{c_i \\in E} \\left\\| W c_i - v_i^* \\right\\|^2 + \\sum_{c_j \\in P} \\left\\| W c_j - W_{\\text{old}} c_j \\right\\|^2\n$$\n\nSpecifically, UCE learns a new attention projection matrix \\\\( W \\\\) that maps erased concept prompts \\\\( c_i \\\\) to substitute vectors \\\\( v^*_i \\\\), while preserving the responses to protected concepts \\\\( c_j \\\\).\n\nOn the other hand, other methods (e.g., Gradient Ascent, TV) use alternative objectives such as increasing the diffusion loss. Even if we suspect that the erasing mechanism removes explicit knowledge of the target concept from the model, the resultant concept distribution is difficult to explicitly compute and categorize. To tackle this challenge, we have thus proposed our suite of evaluations described in the paper as an empirical tool for analyzing erased models.\n\n**“Trade-off … more quantitative analysis”**\n\nWe thank the reviewer for their suggestion. To address it, we define a Combined Method Score, which is an average of the method’s normalized erasing performance (across the different probes), unrelated concept preservation, and FID score. We calculated the Fréchet Inception Distance (FID) on the MS-COCO30k dataset for each model to assess the \"quality\" of images generated by these erased models compared to the original model as yet another axis of evaluation. \n\nThis Combined Method Score reveals several interesting trends: STEREO outperforms ESD-U, the method it builds upon; and RECE similarly improves on its base method, UCE. Although both GA and STEREO achieve near-perfect erasure scores, their overall performance diverges: STEREO ranks highest overall, while GA ranks lowest. This disparity is driven by GA's poor FID and preservation scores, which offset its strong erasure. \n\n|**Rank**|**Method**|**Erasure**|**FID (↓)**|**Preservation**|**Model Score**|\n|---|---|---|---|---|---|\n|1|Stereo|**0.99**|19.5|0.74|**0.81**|\n|2|ESD-U|0.76|17.4|0.86|0.80|\n|3|TaskVec|0.90|18.8|0.79|0.80|\n|4|RECE|0.69|17.5|0.87|0.78|\n|5|UCE|0.60|**16.5**|**0.90**|0.76|\n|6|ESD-X|0.63|17.1|0.87|0.75|\n|7|GA|0.97|21.2|0.74|0.73|\n|8|Base (SD 1.4)|0.00|16.0|1.00|0.50|\n\n\n\n**“theoretical justification for the noise-based probe (app B) relies on some strong assumptions”**\n\nWe thank the reviewer for raising this concern. While our analysis does rely on assumptions such as partial latent retention and the SDE-based formulation of diffusion, we emphasize that this is not intended as a formal proof characterizing the Noise-Based probe. In particular, we used it as a motivation for why introducing noise into the diffusion process would expand the space of “useful” trajectories for recovering images of erased concepts. We have now made this clearer in the revised manuscript.\n\n**“Prior Work”**\n\nThank you for these helpful suggestions. We agree these works provide meaning context to our work and we incorporated these citations into the manuscript. \n\n**“discussing the computational overhead … potential limitations in scalability”**\n\nThank you for this thoughtful suggestion. In Appendix C.2, we report that running the full evaluation suite (spanning 7 erasure methods and 13 concepts across all 6 probes) took approximately two weeks on two NVIDIA A6000 GPUs, or roughly one day per method per concept. We agree that as production systems begin to scale verification across hundreds of concepts and models, this level of computational cost could pose practical limitations. \n\nWhile our framework is designed for comprehensive academic benchmarking, we recognize that production settings may benefit from more lightweight diagnostics. However, several of our introduced probes, such as the noise-based probe and inpainting-based context probe, are training-free and are in fact faster to run than other approaches. \n\nTo illustrate, we provide a rough breakdown of compute cost by probe (as a percentage of total runtime):\n1.  Textual Inversion: 39%  \n2.  UnlearnDiffAtk (UDA): 37%  \n3.  Inpainting: 3%  \n4.  Diffusion Completion: 4%  \n5.  Noise-Based Probe: 7%  \n6.  Dynamic Concept Tracing: 10%  \n\nTaken together, the training-free probes (inpainting, noise, diffusion completion, and concept tracing) require less than 15% of the total runtime. \n\nThank you again for your excellent comments. We will revise the final version of the manuscript to include your kind suggestions. We are happy to continue the discussion at any time until the end of the discussion period. Thank you!"}, {"review_id": "IRf64SeTbU", "reviewer": "Reviewer_r56k", "summary": "The paper proposes a classification of erasure methods into two categories:\n\n•\tGuidance-based erasure methods, which redirect the model’s generation process away from a target concept, while the to-be-erased concept’s knowledge remains intact within the model’s parameters.\n\n•\tDestruction-based erasure methods, which fundamentally suppress or eliminate the underlying knowledge of a concept from the model, making the concept theoretically irrecoverable.\n\nAnother contribution of the paper is an evaluation framework composed of four distinct evaluation methods:\n\n•\tOptimization-based Probing: Employs previously proposed techniques like Textual Inversion or adversarial attacks to search for adversarial prompts that recover the erased concept.\n\n•\tIn-context Probing: A new evaluation method proposed by the authors. The idea is to provide visual cues—such as inpainting masked images or completing unfinished intermediate diffusion generations—as inputs (with visual hints) to test whether the erased concept can still be generated.\n\n•\tTraining-Free Trajectory Probing: Another new evaluation method, which manipulates the diffusion process by adding noise to intermediate steps. As described in Appendix B, this is done by modifying the scaling factor $\\eta$ in the random noise component in DDIM.\n\n•\tDynamic Concept Tracing: Measures the distance between CLIP embeddings of images generated by the original model and the erased one (Section 3.4, Fig. 5). The authors claim that “Gradient Ascent and Task Vector—two destruction-based methods”—tend to generate more consistent replacements for the erased concepts, while guidance-based methods like ESD produce more varied outputs. However, the illustration in Fig. 6 and results in Fig. 5 seem to suggest the opposite. More specifically, in rows 2 and 3, the outputs from ESD converge stably to \"a man,\" while rows 1 and 4 exhibit increasingly varied outputs. In Fig. 5, the centroid deviation for GA and TV increases over time, whereas that for ESD converges, which also aligns with the visualizations in Fig. 6.", "questions": "-\tWhile I like the idea of in-context examples (Section 3.2), I couldn't understand how this module is implemented from the description in the paper. Specifically, in Appendix C.5.4 (Inpainting), it is mentioned that “the inpainting pipeline was based on SD v1.5 and implemented via SDInpaintPipeline.” Does this mean the authors applied unlearning to the inpainting model, rather than to the standard text-to-image SD model?\n\n-\tI don’t understand the discussion in Section 3.4 (Dynamic Concept Tracing). The authors state that “Gradient Ascent and Task Vector—two destruction-based methods—tend to generate more consistent replacements for the erased concepts, while guidance-based methods like ESD produce more varied outputs.” However, Fig. 6 and Fig. 5 seem to indicate the opposite. In rows 2 and 3, the outputs from ESD stably converge to “a man,” while rows 1 and 4 exhibit more variation. In Fig. 5, the centroid deviation of GA and TV increases over time, whereas that of ESD decreases. These results seem inconsistent with the authors' claims.\n\n-\tWhat is the target concept used in the experiments in Section 3.4 for the ESD-x and ESD-u methods? In my experience with ESD, the replacement output is strongly influenced by the choice of target concept, and typically will not default to “a man” unless that is explicitly defined as the target in the objective function.\n\n-\tIn Training-Free Trajectory Probing, the authors propose adding noise to the intermediate latent $x$. What would happen if noise were added to the guidance signal instead (e.g., by perturbing the conditional signal $\\tau(y) + \\text{noise}$ or the classifier-free guidance signal $(\\epsilon(\\tau(y)) - \\epsilon(\\tau(\\text{null})))$)?", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "**Strengths**\n\n•  The paper is well written.\n\n•  I particularly appreciate the idea of using in-context examples (Section 3.2) to provide visual cues for probing the generation capabilities or memory of the erased concepts. Overall, the Section 3 is well written and provide a comprehensive evaluation framework for evaluating concept unlearning.\n\n**Weaknesses**\n\n- Figure 1, while intuitive, may be misleading to me. Specifically, it is unclear or unconvincing why the redirection arrow (black arrow in the middle and right subfigures) should necessarily lead to a nearby concept. This redirection only makes sense if the erasure method—like ESD or UCE—explicitly forces the to-be-erased concept toward a targeted nearby concept, as done in [1], i.e., $\\epsilon(c_e) \\rightarrow \\epsilon(c_t)$ where $c_t \\in B(c_e)$. In standard erasure methods like ESD, UCE, RECE, or STEREO, where the target concept is not explicitly defined and where general or neutral concepts (e.g., “a photo,” an empty string “ ”, or something like “man” or “human”) are used instead, there is no guarantee that the redirected concept will be semantically nearby. \n\n[1] Fantastic Targets for Concept Erasure in Diffusion Models and Where to Find Them\n\n- The use of Textual Inversion (TI) can be highly sensitive to the amount and type of fine-tuning data. With a small number of reference images, TI may not perform well. However, with enough reference images, TI can learn personal or specific concepts—even if those have been erased.\n\n- Another concern is the definition of “concept”, which can be ambiguous. For example, a concept like “an astronaut monkey” may not appear in the training data but can still be generated by the model based on the core concepts of “astronaut” and “monkey.” Similarly, abstract or nuanced concepts such as “nudity” or artistic styles, though complex, may still be reconstructed from more basic elements (e.g., “human body,” “human skin”). Thus, I believe that achieving complete destruction (as claimed in destruction-based removal) may be unrealistic. This is supported by the results in Table 1: GA, labeled as a destruction-based method, can still regenerate the erased concept using Textual Inversion. I suspect that with a large enough reference dataset, TI would recover the concept even more effectively. Therefore, while the modeling distinction between guidance-based and destruction-based removal is conceptually useful, I believe most current methods—including those labeled as destruction-based—are closer to guidance-based in practice.", "was_revised": true, "final_justification": "in my opinion, this paper still offers valuable contributions that are relevant and would be of interest to the NeurIPS community:\n\nWhile the current definitions of the two unlearning mechanisms are not yet rigorous, I believe that the conceptual proposal and awareness of these two paradigms are meaningful and necessary. Although I cannot pre-judge the final revision, I trust in the authors’ ability to refine and improve the presentation.\n\nUnlike the Inpainting Probe, the proposed Diffusion Completion (Section 3.2) and Noise-Based Probing (Section 3.3) methods appear to be more general and scalable. I consider these to be interesting directions for evaluating unlearning in diffusion models.\n\nIn conclusion, I would like to keep my rating and lean towards accepting this paper.", "rebuttal": "We thank Reviewer r56k for their positive assessment of our work and for highlighting the clarity of our writing and the novelty of the in-context probing evaluation. We are especially glad that you found Section 3's evaluation framework comprehensive and well motivated.\n\n **“it is unclear or unconvincing why the redirection arrow (black arrow in the middle and right subfigures) should necessarily lead to a nearby concept.”**\n\nThank you for your question. The arrows on Fig.1 come to illustrate the idea of an alternative generation, “chosen” by a model that underwent a destruction based erasure. As shown in Fig.5 and Fig.6, the alternative generation leads to a nearby concept to the original one when the erasure strength is small (erasure strength being the method “strength” parameter, e.g., fine-tuning epochs). Even and especially in models that do not explicitly define “neutral concepts”. Yet, as the strength parameter increases, the alternative generation is indeed driven to be further away from the original concept.\n\nIn any case, we would like to clarify Fig.1 comes to illustrate the idea of the alternative concept distance from the original one, and not necessarily to claim it is nearby (or faraway) for any specific method. We have now further clarified this in the caption.\n\n \n **“The use of Textual Inversion (TI) can be highly sensitive to the amount and type of fine-tuning data”**\n\nWe thank the reviewer for their comment. We report below further experiments to explore the sensitivity of the Textual inversion attacks on our chosen erased models, by training TI embeddings on 1, 10, 100, and 300 images for five representative erasure methods.\n\nWith limited reference images, TI may indeed struggle to recover erased concepts in some cases And as shown in the table below, increasing the number of TI training images significantly improves both CLIP scores and classification accuracy for certain models, indicating that erased concepts can often be relearned through TI if sufficient data is provided.\n\nNotably, models like UCE and ESD-X showed substantial increases in classification accuracy as the number of used images increased, whereas methods such as GA and TV remained more resistant to TI attacks.\n\n| | GA | UCE | ESD-X | ESD-U | TV |\n|------------------------|-------|-------|-------|-------|-------|\n| **1 Image** | | | | | |\n| CLIP | **20.5** | 26.3 | 25.9 | 24.7 | 22.0 |\n| Class Acc. (%) | **0.0** | 35.0 | 30.0 | 10.0 | 0.0 |\n| **10 Images** | | | | | |\n| CLIP | **21.8** | 28.6 | 28.9 | 26.5 | 23.5 |\n| Class Acc. (%) | **0.2** | 58.0 | 51.0 | 20.0 | 1.0 |\n| **100 Images** | | | | | |\n| CLIP | **22.7** | 30.7 | 30.6 | 28.0 | 25.1 |\n| Class Acc. (%) | **0.6** | 71.2 | 65.9 | 31.8 | 6.2 |\n| **300 Images** | | | | | |\n| CLIP | **23.0** | 30.9 | 30.3 | 30.2 | 26.4 |\n| Class Acc. (%) | **1.0** | 72.3 | 67.3 | 33.9 | 8.5 |\n\n  **\"I believe that achieving complete destruction (as claimed in destruction-based removal) may be unrealistic.\"**\n\nWe agree that achieving complete destruction of a concept may be difficult in practice, or even impossible particularly when powerful recovery strategies like Textual Inversion (TI). \n\nOur intention is not to claim that current methods fully realize the destruction based ideal case, but rather to organize the space of existing approaches and motivate future work that pushes closer toward true destruction.\n\nThat said, we appreciate the reviewer’s broader point: while stronger methods such as GA are better at thoroughly removing concepts, we acknowledge they may still not achieve a complete destruction of the concept. While developing fully robust methods may remain an open challenge, our paper aims to examine existing approaches and motivate future work that pushes closer toward true destruction.\n\n  **“Does this mean the authors applied unlearning to the inpainting model, rather than to the standard text-to-image SD model?”**\n\nThank you for the question. The unlearning was applied only to SD v1.4 models. We found that using a base SD v1.5 inpainting pipeline with an SD v1.4 erased UNet produced more stable and visually coherent outputs than using the SD v1.4 inpainting pipeline. \n \n\n**Regarding Figure.6: Consistent generations**\n\nIn line 196, with the claim: “Gradient Ascent and Task Vector often converge on a consistent alternative concept”, our intention was to divert the reader’s attention to the evolution of the concept through the unlearning process. This can be seen in row 2, GA’s outputs throughout the unlearning training smoothly converges to the same ‘mushy’ concept whereas ESD has a more ‘erratic’ convergence to its final concept. We have clarified this better in our text. \n\n**Regarding Figure.5: Centroid plots**\n\nIn Fig. 5, we do not plot standard deviation across generations. Rather, we show the average distance between the original and alternative generation embeddings. GA and TV show steady increases, indicating a smooth drift away from the original concept. ESD-U and ESD-X, however, exhibit sharp spikes in this metric: corresponding to the abrupt visual transitions seen in Fig. 6.\nWe will clarify it in the final version of the manuscript and add the distribution images to show the variations of each model.\n\n\n\n  \n**What is the target concept used in the experiments in Section 3.4 for the ESD-x and ESD-u methods?**\n\nWe thank the reviewer for their observation and would like to clarify. The target concept used for these methods was \"vincent van gogh self portrait.\" Accordingly, the trajectories converged to \"a man\", diverging away from Van Gogh as the erasure progressed. In accordance with the reviewer's comment about the target concept having a strong influence on the replacement output, we have run ESD-u and ESD-x with the target concept \"a painting in the style of van gogh,\" and the resultant trajectories converged to images of a painting.\n  \n\n**“What would happen if noise were added to the guidance signal instead”**\n\nWe thank the reviewer for their insightful suggestion. To investigate this, we conducted a detailed analysis of perturbing different components of the classifier-free guidance expression:\n\n$$\n\\epsilon_{\\text{guided}} = \\epsilon_u + s \\cdot (\\epsilon_c - \\epsilon_u)\n$$\n\nWe find that perturbing the conditional prediction ($\\epsilon_c \\rightarrow \\epsilon_c + \\sigma z$) or the guidance vector ($( \\epsilon_c - \\epsilon_u ) \\rightarrow ( \\epsilon_c - \\epsilon_u + \\sigma z )$) results in the same final expression:\n\n$$\n\\epsilon_{\\text{guided}} = \\epsilon_u + s \\cdot (\\epsilon_c - \\epsilon_u) + s \\sigma z\n$$\n\nHowever, perturbing the unconditional prediction ($\\epsilon_u \\rightarrow \\epsilon_u + \\sigma z$) yields a subtly different form:\n\n$$\n\\epsilon_{\\text{guided}} = (\\epsilon_u + \\sigma z) + s \\cdot (\\epsilon_c - (\\epsilon_u + \\sigma z)) \\\\\n= \\epsilon_u + s \\cdot (\\epsilon_c - \\epsilon_u) + (1 - s) \\sigma z\n$$\n\nNotably, the noise term here is scaled by $(1 - s)$, which becomes negative when $s > 1$. This introduces an anti-aligned perturbation relative to the guidance direction, effectively suppressing or counteracting the text guidance. To explore this effect, we now include both conditional and unconditional perturbation variants in the table below:\n\n|                        | **ESD-u** | **ESD-x** | **UCE** |\n|------------------------|----------|----------|---------|\n| **CLIP Score (↑)**     |          |          |         |\n| Unconditional-Signal   | 26.90    | 27.35    | 27.10   |\n| Conditional-Signal     | 25.80    | 29.10    | 29.05   |\n| Noising Probe          | **27.99**| **30.56**| **30.65** |\n| **Top-1 Accuracy (%) (↑)** |      |          |         |\n| Unconditional-Signal   | 25.90    | 28.50    | 19.35   |\n| Conditional-Signal     | 23.62    | 28.37    | 16.61   |\n| Noising Probe          | **27.70**| **30.70**| **21.90** |\n\n\nInterestingly, we observed that perturbing the unconditional signal occasionally led to out-of-distribution generations, often producing semantically ambiguous or hallucinatory outputs. Despite this, concepts that were difficult to recover using the standard noising probe (like English Springer Spaniel), were better recovered using the unconditional perturbation. This suggests that such perturbations may expose residual concept traces in the models learned prior that are not typically activated during normal guidance.\n\nWe sincerely thank the reviewer for their thoughtful suggestions and questions. We will revise the final version of the manuscript to improve clarity, and we welcome the opportunity to continue this discussion."}, {"review_id": "uxmg2Mjk40", "reviewer": "Reviewer_Bk4k", "summary": "This paper studies how existing approaches erase concepts from diffusion models and discusses their limitations. Two conceptual models, i.e., guidance-based avoidance and destruction-based removal, for the erasure mechanism in diffusion models are proposed. Furthermore, some probing methods are applied to evaluate existing removal methods.", "questions": "See above.", "limitations": "Yes.", "rating": 4, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths\n- The motivation is clear, and the problem of concept removal is fundamental.\n- The paper is well-written.\n- The proposed probing methods clearly present the difference among methods. These methods provide an effective framework for comprehensive evaluation of concept removal methods in the future.\n\nWeaknesses\n- Even though the two conceptual models are intuitive and easy to understand, this paper could benefit from deeper analysis and theoretical modeling of them. For example, what is the essential difference between guidance-based avoidance and destruction-based removal? If the target concept is always avoided in generation, can we also say it is a kind of reduction in its likelihood?\n- This paper stops by identifying limitations of existing methods and fails to propose a better data erasure method. Therefore, I think the novelty is limited to some extent.", "was_revised": true, "final_justification": "After the discussion, I still feel this paper could benefit more from deeper theoretical modeling and more empirical evidence of the difference between guidance-based avoidance and destruction-based removal. Moreover, as also supported by Reviewer H6xi, this paper does not provide a \"novel research perspective/framework,\" which restricts the contribution and novelty. Nonetheless, I personally think this paper is still interesting, and the reasons to accept slightly outweigh reasons to reject. Therefore, I decide to maintain my current rating.", "rebuttal": "We thank the reviewer for their thoughtful summary and positive feedback. We appreciate that the reviewer found the motivation clear and the problem well framed, and the probing methods effective. We are especially encouraged by your comment that the evaluation framework may serve as a useful tool for future work in this area.\n\n**“what is the essential difference between guidance-based avoidance and destruction-based removal?”**\n\nTo clarify, we suggest that the key difference between guidance-based avoidance and destruction-based removal lies in the resulting distribution of the erased concept after erasure. With guidance based methods, the unlearning algorithm pushes the conditional probability $P(X | c)$, where $c$ is the erased concept, to another known distribution. For example, with UCE we can write the erased distribution $P(X | c*)$ where $c*$ is the anchor concept, which comes from the following loss function:\n\n$$\n\\mathcal{L}(W) = \\sum_{c_i \\in E} \\left\\| W c_i - v_i^* \\right\\|^2 + \\sum_{c_j \\in P} \\left\\| W c_j - W_{\\text{old}} c_j \\right\\|^2\n$$\n\nSpecifically, UCE learns a new attention projection matrix \\\\( W \\\\) that maps erased concept prompts \\\\( c_i \\\\) to substitute vectors \\\\( v^*_i \\\\), while preserving the responses to protected concepts \\\\( c_j \\\\).\n\nOn the other hand, destruction based methods fundamentally remove the knowledge of the concept, reducing the overall likelihood that samples from $P(X)$ exhibit the erased concept. A canonical example of this would be retraining the model on data that excludes the target concept. However, even if we suspect that the erasing mechanism removes explicit knowledge of the target concept from the model, the resultant concept distribution is difficult to explicitly compute and categorize. To tackle this challenge, we propose our suite of evaluations described in the paper as an empirical tool for analyzing these erased models. We will update the final draft to make this more clear.\n\n**\"This paper stops by identifying limitations of existing methods\"**\n\nWhile our paper focuses on identifying the limitations of existing erasure methods rather than proposing a new one, similar studies have often paved the way for developing stronger approaches [1,2,3,4]. For instance, the STEREO method (the most robust and highest ranked model in our evaluation framework) was developed in response to Pham et al.'s [1] finding that textual inversion can circumvent erasure in ESD. We hope our probing insights inspire more robust erasure strategies, such as integrating context-aware probes during training or leveraging the noise-based probe scheduling setup to better capture diverse generation paths.\n\n\n\n[1] Pham, Minh, et al. \"Circumventing Concept Erasure Methods For Text-To-Image Generative Models.\" The Twelfth International Conference on Learning Representations.‏\n[2] Srivatsan, Koushik, et al. \"Stereo: A two-stage framework for adversarially robust concept erasing from text-to-image diffusion models.\" Proceedings of the Computer Vision and Pattern Recognition Conference. 2025.‏\n[3] Robey, Alexander, et al. \"Smoothllm: Defending large language models against jailbreaking attacks.\" arXiv preprint arXiv:2310.03684 (2023).\n[4] George, Naveen, et al. \"The Illusion of Unlearning: The Unstable Nature of Machine Unlearning in Text-to-Image Diffusion Models.\" Proceedings of the Computer Vision and Pattern Recognition Conference. 2025.\n\nThank you very much for your comments. We will include all the revisions in the final version of the paper. We are happy to continue the discussion any time until the end of the discussion period. Thank you!"}, {"review_id": "UIJLwzYEg3", "reviewer": "Reviewer_H6xi", "summary": "This paper studies the robustness of concept removal in text2img diffusion models. The authors first propose a concept map of how the erasure methods work and then evaluate the methods with adversarial attacks, inpanting, and random pertubations.", "questions": "Please see weakness.", "limitations": "Yes", "rating": 2, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 1, "originality": 1, "strengths_and_weaknesses": "== Strength\n1. The proposed concept map makes sense intuitively.\n2. The paper covers several erasure methods and three attack perspectives.\n\n== Weakness\n1. The trajectory probing method introduced by the authors does not cover vulnerabilities beyond gradient-based and inpainting-based attacks, and the method itself is too naive. Since the ultimate goal is to uncover the supposedly erased concepts, why not using classifiers/conditions to guide the generation/searching process, which will be much stronger than random guessing.\n2. There exists tension between erasure effect and side effect is well-known. This paper does not expand our knowledge in this trade-off with experiements/thoerys.\n3. Validness of the evaluation metrices is not guranteed. Are the classifier/CLIP highly correlated with human perception? Should we introduce non-neural network based evaluations? Does it make sense to use an ensemble of classifiers to improve accuracy?\n4. The concept map is not rigorously verified with experiments/theorys.\n\nIn summary, this paper is limited in contribution due to lack of technical novelty and new experiemental findings.", "was_revised": true, "final_justification": "**Recommendation: Reject**\n\nI recommend rejecting this paper due to significant concerns regarding its novelty, depth of analysis, and engagement with prior work. While the topic is relevant, the contribution is not substantial enough for publication at NeurIPS.\n\n---\n\n### **Key Weaknesses**\n\n1.  **Incremental Contribution:** The paper's core contribution is applying existing attack methods to existing unlearning defenses. This is a straightforward combination of prior work that yields predictable results. The findings, while confirming that defenses are not perfectly robust, lack the novelty and surprise expected of a top-tier publication.\n\n2.  **Superficial Analysis:** The work functions more as an experimental report than a deep scientific investigation. It demonstrates vulnerabilities but fails to provide a rigorous analysis of *why* these defenses fail. The absence of new theoretical insights, a novel framework, or a deeper understanding of the failure mechanisms limits its scientific impact.\n\n3.  **Incomplete Literature Review:** The related work section is critically incomplete. It fails to cite or discuss several recent and relevant papers that have already established the unreliability of diffusion unlearning methods, including key works like [1], [2], and [3]. This omission undermines the paper's claims to originality and its overall scholarly foundation.\n\n---\n\nLastly, it is widely recognized in the adversarial ML community that constructing robust defenses is significantly more challenging than devising attacks. An attack paper at a premier venue should therefore offer more than a simple demonstration of vulnerability; it should provide novel insights or uncover fundamental flaws. Accepting this work, which is primarily an application of existing techniques, would risk lowering the standard for publication and could inadvertently discourage the more difficult and necessary research into developing robust defenses.", "rebuttal": "We thank the reviewer for their feedback. We are glad you found our conceptual framework intuitive. We address specific concerns below:\n\n**\"trajectory probing method … does not cover vulnerabilities beyond gradient-based and inpainting-based attacks” \"using classifiers/conditions to guide the generation/searching process\"**\n\nWe appreciate this thoughtful suggestion. One of the key strengths of the noising probe is its simplicity and training-free nature, and it can outperform other evaluation methods in specific cases (see Figure 7 for example, or the NSFW study in response to Reviewer jc67).\n\nThat said, your comment inspired us to explore classifier-guided generation as a complementary approach.  Following the method outlined in “Diffusion Models Beat GANs on Image Synthesis” (Dhariwal & Nichol), we implemented classifier guidance during generation. In addition to using their pre-trained classifier, we also trained a custom binary classifier for garbage truck on noised latents from Stable Diffusion 1.4 using the ImageNet-1k dataset.\n\nWhile classifier guidance alone provided some benefit, combining it with the noise-based probe significantly boosted performance: even surpassing UDA on the garbage truck class.\n\n|**Metric / Method**|ESDx|ESD-U|UCE|STEREO|\n|---|---|---|---|---|\n|OpenAI Classifier (CLIP, Acc %)|24.5, 2.0%|24.0, 1.5%|21.3, 3.2%|20.3, 0.0%|\n|SD 1.4 Classifier (CLIP, Acc %)|27.1, 5.0%|26.5, 4.1%|22.3, 6.0%|21.4, 0.5%|\n|Noise-Based Probe (CLIP, Acc %)|26.1, 5.0%|28.3, 4.4%|28.3, 4.4%|25.7, 1.0%|\n|Noise-Based Probe + OpenAI Classifier (CLIP, Acc %)|27.0, 7.0%|28.3, 28.4%|28.3, 28.4%|26.3, 1.3%|\n|Noise-Based Probe + SD 1.4 Classifier (CLIP, Acc %)|**29.3, 43.0%**|**28.3, 28.4%**|**29.4, 50.0%**|**26.7, 1.5%**|\n\n**“tension between erasure effect and side effect is well-known”**\n\nWhile we acknowledge that such tradeoffs have been observed, in our paper we further investigate this tension. To emphasize our findings, we report each method’s performance along three key axes: erasure effectiveness, FID score, and unrelated concept preservation.\n\nWe define a Combined Method Score, which is an average of the method’s normalized erasing performance (across the different probes), unrelated concept preservation, and FID score. Our score reveals several interesting trends: STEREO outperforms ESD-U, the method it builds upon; and RECE similarly improves on its base method, UCE. Although both GA and STEREO achieve near-perfect erasure scores, their overall performance diverges: STEREO ranks highest overall, while GA ranks lowest.\n\n  \n|**Rank**|**Method**|**Erasure**|**FID (↓)**|**Preservation**|**Model Score**|\n|---|---|---|---|---|---|\n|1|Stereo|**0.99**|19.5|0.74|**0.81**|\n|2|ESD-U|0.76|17.4|0.86|0.80|\n|3|TaskVec|0.90|18.8|0.79|0.80|\n|4|RECE|0.69|17.5|0.87|0.78|\n|5|UCE|0.60|**16.5**|**0.90**|0.76|\n|6|ESD-X|0.63|17.1|0.87|0.75|\n|7|GA|0.97|21.2|0.74|0.73|\n|8|Base (SD 1.4)|0.00|16.0|1.00|0.50|\n\n  **“Are the classifier/CLIP highly correlated with human perception?” “Should we introduce non-neural network based evaluations”**\n\nThank you for the questions. Yes, classifiers are correlated with human perception and are often used for similar purposes [1,2,3,4]. Furthermore, to complement our automated evaluation metrics (e.g., CLIP and classifier accuracy), we conducted a small-scale human evaluation to assess whether erased concepts were still recognizable to non-expert observers.\n\n  We recruited human subjects to manually classify generated images for ESDX, UCE, and GA, and **3 concepts** (English Springer Spaniel, Cassette Player, Van Gogh) across **5 evaluation settings**:\n- Standard Prompt\n\n- Inpainting\n\n- Noise-Based Probe\n\n- Textual Inversion\n\n- UnlearnDiffAtk\n\nEach setting included 20 images per concept, for a total of **900 images** (3 models x 3 concepts × 5 evaluations × 20 images).\n\nBelow, we report the average human classification accuracies (in %) alongside the automated classifier results from the main paper for comparison:\n\n|**Evaluation**|**Automated Classifier Accuracy (%)**|**Human Classification Accuracy (%)**|\n|---|---|---|\n|Standard Prompt|2.3|3.2 ± 0.9|\n|Inpainting|61.7|64.3 ± 3.2|\n|Noise-Based Probe|17.9|16.1 ± 1.3|\n|Textual Inversion|45.2|41.7 ± 2.0|\n|UnlearnDiffAtk|18.3|18.5 ± 1.7|\n\n  \n\nThe human evaluation results generally aligned with our automated metrics. Across all five evaluation settings and four models, the relative performance ordering was preserved: GA produced the lowest recognition rates (e.g., 1.3% human vs. 0.6% automated on standard prompts), while human classification of inpainting results for ESD-x and GA averaged 67.5% and 75.6%, closely tracking automated results in 69.1% for ESD-X and 61.7% for GA.\n\n  \n\nThese observations suggest that while human and automated judgments mostly agree, human evaluation provides complementary insights, particularly in borderline cases where visual quality or conceptual ambiguity may affect recognition.\n\n  \n\n[1] Zhang, Richard, et al. \"The unreasonable effectiveness of deep features as a perceptual metric.\" Proceedings of the IEEE conference on computer vision and pattern recognition. 2018.\n\n[2] Kumar, Manoj, et al. \"Do better ImageNet classifiers assess perceptual similarity better?.\" Transactions on Machine Learning Research.\n\n[3] Gandikota, Rohit, et al. \"Unified concept editing in diffusion models.\" Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision. 2024.\n\n[4] Gong, Chao, et al. \"Reliable and efficient concept erasure of text-to-image diffusion models.\" European Conference on Computer Vision. Cham: Springer Nature Switzerland, 2024.\n\n  \n**“Does it make sense to use an ensemble of classifiers to improve accuracy?”**\n\n While we believe different classifiers tell a similar story, we are happy to report results with other classifiers as well. For example, see the table below, where we calculated the pearson correlation between other classifiers trained on ImageNet and the resnet-50 classifier we used:\n\n  |**Model**|**Overall Pearson r with ResNet-50**|\n|---|---|\n|EfficientNet-B4|0.796|\n|**ConvNeXt-Base**|**0.814**|\n|ViT-B/16|0.778|\n\nWe find overall pearson correlations of ~0.8, which suggest strong alignment between the classifiers.\n\n**“The concept map is not rigorously verified”**\n\nThe concept map in Fig. 1 is intended to illustrate the two extremes of concept erasure we consider: guidance-based avoidance and destruction-based erasure. While the probing techniques we propose offer empirical insights into the erasing mechanisms of different methods, we acknowledge that a more rigorous theoretical foundation is needed. We view this work as a first step and hope it inspires further research from the community.\n\nOur motivation behind guidance vs destruction categorization is based on the resultant distribution of the erased concept post erasure. With guidance based methods, the unlearning algorithm pushes the conditional probability $P(X | c)$, where $c$ is the erased concept, to another known distribution. For example, with UCE we can write the erased distribution $P(X | c*)$ where $c*$ is the anchor concept, which comes from the following loss function:\n\n$$\n\\mathcal{L}(W) = \\sum_{c_i \\in E} \\left\\| W c_i - v_i^* \\right\\|^2 + \\sum_{c_j \\in P} \\left\\| W c_j - W_{\\text{old}} c_j \\right\\|^2\n$$\n\nSpecifically, UCE learns a new attention projection matrix $\\( W \\)$ that maps erased concept prompts $\\( c_i \\)$ to substitute vectors $\\( v^*_i \\)$, while preserving the responses to protected concepts $\\( c_j \\)$.\n\nOn the other hand, other methods (e.g., Gradient Ascent, TV) use alternative objectives such as increasing the diffusion loss. Even if we suspect that the erasing mechanism removes explicit knowledge of the target concept from the model, the resultant concept distribution is difficult to explicitly compute and categorize. To tackle this challenge, we have proposed our suite of evaluations described in the paper as an empirical tool for analyzing erased models.\n\nThank you very much for your comments. If our clarifications address your concerns, we would greatly appreciate an updated assessment. If not, please let us know what can be further improved; we are happy to continue the discussion any time until the end of the discussion period. Thank you!"}]

Author rebuttal:

Meta-review: This paper attempts to address an important question that the concept unlearning community is grappling with across the board: are current algorithms actually removing information or simply suppressing them. This is a very complicated question and this paper makes some good first steps towards understanding this phenomenon. The paper starts by categorizing concept unlearning methods as suppression based or destruction based. It then provides four different probes to measure this distinction. 

Reviewers appreciated the novelty and importance of the insights provided in this paper. Especially regarding how to better measure whether true unlearning has happened. The main weaknesses of this paper at first were the lack of rigour in the categorization of guidance based vs. destruction based erasure, the conclusions that could be drawn from the robustness experiments, and the computational costs from running these probes. The majority of reviewers were satisfied with the responses to these weaknesses with some remaining minor concerns. I strongly encourage the authors to focus on improving the clarity of the distinction between guidance and destruction based erasure and grounding it in more rigorous interpretations as suggested by 56k.  

While one reviewer felt strongly about rejection, having gone through more of the paper myself and all of the reviews + rebuttals I am recommending acceptance. I believe that the insights in this paper and the proposed probes will be a good starting point for the community to better understand just how poorly our current unlearning algorithms are performing.
Decision: Accept (poster)