Title: CURE: Concept Unlearning via Orthogonal Representation Editing in Diffusion Models
Venue: NeurIPS 2025
Accepted: yes
Keywords: Concept Removal

Text-to-Image Models
Abstract: As Text-to-Image models continue to evolve, so does the risk of generating unsafe, copyrighted, or privacy-violating content. Existing safety interventions - ranging from training data curation and model fine-tuning to inference-time filtering and guidance - often suffer from incomplete concept removal, susceptibility to jail-breaking, computational inefficiency, or collateral damage to unrelated capabilities. In this paper, we introduce CURE, a training-free concept unlearning framework that operates directly in the weight space of pre-trained diffusion models, enabling fast, interpretable, and highly specific suppression of undesired concepts. At the core of our method is the Spectral Eraser, a closed-form, orthogonal projection module that identifies discriminative subspaces using Singular Value Decomposition over token embeddings associated with the concepts to forget and retain. Intuitively, the Spectral Eraser identifies  and isolates features unique to the undesired concept while preserving safe attributes. This operator is then applied in a single step update to yield an edited model in which the target concept is effectively unlearned - without retraining, supervision, or iterative optimization. To balance the trade-off between filtering toxicity and preserving unrelated concepts, we further introduce an Expansion Mechanism for spectral regularization which selectively modulates singular vectors based on their relative significance to control the strength of forgetting. All the processes above are in closed-form, guaranteeing extremely efficient erasure in only $2$ seconds. Benchmarking against prior approaches, CURE achieves a more efficient and thorough removal for targeted artistic styles, objects, identities, or explicit content, with minor damage to original generation ability and demonstrates enhanced robustness against red-teaming. Project Page at \url{https://sites.google.com/view/cure-unlearning/home}.


Peer reviews:
comments: SUMMARY:
This paper presents and evaluates a concept unlearning method (CURE) for text-to-image diffusion models. Conceptually, the method uses the projection of the text embeddings for an input prompt onto a basis for the subspace spanned by the concepts to be unlearned. Specifically, they "subtract out" the projection onto the unlearned concept and "add back in" the projection onto the intersection between unlearned concepts and concepts to be preserved. Because this can be directly encoded in the cross-attention weights, it is an efficient, one-time operation to unlearn a concept while retaining related ones.

STRENGTHS AND WEAKNESSES:
# Strengths
The proposed method is simple and appears to be highly effective. Each component of the method is well-motivated and clearly explained. The experiments are thorough, though I'm not well-positioned to evaluate the particular models and datasets used.

# Weaknesses
The user must explicitly provide concepts to be preserved, which may end up being a large set. The authors provide experiments in which they have empty preserved sets, and the results still look fairly good. It could help to make this more explicit in the text.

I would have liked to see experiments showing the effect of varying $\alpha$ on both image and unlearning quality.

# Minor comments
- l. 71: "an singular-value" -> "a singular-value"
- l. 226 "a 1000" -> "1000"

QUESTIONS:
No particular questions, but feel free to address any of the points above

LIMITATIONS:
yes
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-06-30

comments: SUMMARY:
This paper presents CURE, a training agnostic method for removing undesired concepts in diffusion models. At the core of the methodology, CURE leverages SVD before removing out projected features tied to the removal concepts in closed-form without necessitating any model retraining. Additional, experimental results with removing artist styles, explicit content, and etc shows strong performance with minimal impact on unrelated content.

STRENGTHS AND WEAKNESSES:
The reviewer notes the following strengths and weaknesses.

Strengths:
- CURE is a training-free method for concept unlearning that is shown to be effective across a wide range tasks (i.e. artist style, nudity, and etc).
- The underlying methodology is mathematically sound & intuitive as well as shown to be able preserve the non-removed concepts.
- The paper is well-written and provides extensive empirical evaluation across multiple tasks and comparative methods.

Weaknesses:
- The reviewer is concerned about the computational overhead of SVD and closed-form calculations.
- Additionally, certain hyperparameters (such as alpha) may be difficult to find reasonably in practice.

QUESTIONS:
The reviewer notes the following questions:
- The author's note on potential misuse with erase forensic watermarks and how gated model release protocols could potentially address certain misuse. If the authors can expand upon this and further address this issue.

LIMITATIONS:
Yes
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-06-30

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nIn this paper, the authors propose CURE, a training-free concept editing method for machine unlearning in diffusion models. The method operates by patching the key-value matrices of the cross-attention module. This is achieved using a projection matrix designed to filter out the component of embeddings related to the \"forget\" concepts that is orthogonal to the \"retain\" concepts, thereby enabling precise unlearning. Through a series of experiments, the authors demonstrate the effectiveness of CURE compared to several machine unlearning baselines.\n\nSTRENGTHS AND WEAKNESSES:\nThe primary strengths of this work are as follows:\n\n1. The proposed method is simple yet effective. It directly modifies the key-value matrices, a strategy that incurs no additional computational overhead during inference.\n\n2. The method has demonstrated empirical robustness against advanced prompt attacks, which is a crucial characteristic for any unlearning method to be practically viable.\n\nThe weaknesses of this work are as follows:\n\n1. The evaluation in Table 4 could be more informative. Rather than reporting accuracy across all remaining classes, the analysis would be more compelling if it focused on classes semantically similar to the forgotten class. For unrelated classes, the concept subspaces are likely already orthogonal, which does not effectively highlight the contribution of the proposed orthogonal editing.\n\n2. The experiments do not fully substantiate the paper's central claims regarding the preservation of generation quality. The authors explicitly state in their Problem Setup (Section 3.2) that defining a \"retain set\" R is \"key to preserving model performance on untargeted content when erasing concepts,\" especially when forget and retain concepts share attributes (e.g., $F \\cap R \\neq \\emptyset$). However, most of the key experiments, such as unsafe content erasure and object erasure, do not appear to to define a retain set. This omission is significant because it means the experiments do not test the very mechanism the paper posits for preserving quality. Consequently, the core claim from the introduction (Lines 119-123) that CURE preserves generation quality better than prior works is not adequately supported by the provided evidence.\n\n3. In Table 3, the reported Attack Success Rate (ASR) under the UnlearnDiffAtk benchmark shows MACE (0.176) and SA (0.268) performing best. It is unclear why the result for CURE (0.281) is underlined, as this typically indicates the best performance.\n\n4. The authors should clarify the rationale for using a NudeNet threshold of 0.6 in Table 2, especially when prior works (e.g., ESD, UCE) have used the detector's default value. An explanation for this deviation is needed.\n\n5. The paper is missing a crucial ablation study on the sensitivity of the hyperparameter $\\alpha$.\n\nQUESTIONS:\n1. Could the authors provide more detail on how the concept subspaces are determined for each task? For the I2P task, for instance, were the original I2P prompts used directly to define the subspace?\n\n2. What is the minimum number of prompts required to perform a stable Singular Value Decomposition (SVD) for defining the concept subspace?\n\n3. (See Weakness 4) Could the authors justify their choice of a 0.6 threshold for NudeNet, as this differs from the default values used in prior work?\n\nLIMITATIONS:\nYes, the authors have adequately addressed the limitations and potential negative societal impact of their work.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-01"}

comments: SUMMARY:
This paper introduces a training-free framework for concept unlearning inT2I diffusion models. The core of the proposed method is the Spectral Eraser, a closed-form operator that constructs discriminative subspaces via SVD over token embeddings for concepts to “forget” and “retain”. This operator is used to directly modify cross-attention weights, allowing for efficient erasure of undesired concepts (e.g., NSFW content, styles, objects, or identities) without model training. In addition, the paper introduces a Spectral Expansion mechanism to control forgetting strength via regularization.

STRENGTHS AND WEAKNESSES:
Strengths
1. The proposed method is mathematically principled and clearly grounded in spectral geometry.
2. Experiments are comprehensive, covering diverse concepts (artists, objects, identities, NSFW).
3. The approach is significantly more efficient, requiring only a two-second model edit without retraining.

Weaknesses
1. While the approach is motivated by geometric intuition and classical regularization, this paper lacks deeper theoretical guarantees (e.g., bounds on erasure effectiveness vs. preservation trade-offs).
2. The method assumes the embedding space reliably captures concept semantics. If embeddings are noisy or misaligned, the projection could behave unexpectedly.

QUESTIONS:
It would be good to consider adversarial training based concept unlearning [1] as a strong baseline.

[1] Zhang, Y., Chen, X., Jia, J., Zhang, Y., Fan, C., Liu, J., ... & Liu, S. (2024). Defensive unlearning with adversarial training for robust concept erasure in diffusion models. Advances in neural information processing systems, 37, 36748-36776.

LIMITATIONS:
yes
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-03