Title: When Are Concepts Erased From Diffusion Models?
Venue: NeurIPS 2025
Accepted: yes
Keywords: Concept Erasure
Abstract: In concept erasure, a model is modified to selectively prevent it from generating a target concept. Despite the rapid development of new methods, it remains unclear how thoroughly these approaches remove the target concept from the model. We begin by proposing two conceptual models for the erasure mechanism in diffusion models: (i) interfering with the model’s internal guidance processes, and (ii) reducing the unconditional likelihood of generating the target concept, potentially removing it entirely. To assess whether a concept has been truly erased from the model, we introduce a comprehensive suite of independent probing techniques: supplying visual context, modifying the diffusion trajectory, applying classifier guidance, and analyzing the model's alternative generations that emerge in place of the erased concept. Our results shed light on the value of exploring concept erasure robustness outside of adversarial text inputs, and emphasize the importance of comprehensive evaluations for erasure in diffusion models.


Peer reviews:
comments: SUMMARY:
This paper studies the robustness of concept removal in text2img diffusion models. The authors first propose a concept map of how the erasure methods work and then evaluate the methods with adversarial attacks, inpanting, and random pertubations.

STRENGTHS AND WEAKNESSES:
== Strength
1. The proposed concept map makes sense intuitively.
2. The paper covers several erasure methods and three attack perspectives.

== Weakness
1. The trajectory probing method introduced by the authors does not cover vulnerabilities beyond gradient-based and inpainting-based attacks, and the method itself is too naive. Since the ultimate goal is to uncover the supposedly erased concepts, why not using classifiers/conditions to guide the generation/searching process, which will be much stronger than random guessing.
2. There exists tension between erasure effect and side effect is well-known. This paper does not expand our knowledge in this trade-off with experiements/thoerys.
3. Validness of the evaluation metrices is not guranteed. Are the classifier/CLIP highly correlated with human perception? Should we introduce non-neural network based evaluations? Does it make sense to use an ensemble of classifiers to improve accuracy?
4. The concept map is not rigorously verified with experiments/theorys.

In summary, this paper is limited in contribution due to lack of technical novelty and new experiemental findings.

QUESTIONS:
Please see weakness.

LIMITATIONS:
Yes
TITLE: Official Review
CLARITY: 3
IMPACT: 1
ORIGINALITY: 1
DATE: 2025-06-27

comments: SUMMARY:
This paper studies how existing approaches erase concepts from diffusion models and discusses their limitations. Two conceptual models, i.e., guidance-based avoidance and destruction-based removal, for the erasure mechanism in diffusion models are proposed. Furthermore, some probing methods are applied to evaluate existing removal methods.

STRENGTHS AND WEAKNESSES:
Strengths
- The motivation is clear, and the problem of concept removal is fundamental.
- The paper is well-written.
- The proposed probing methods clearly present the difference among methods. These methods provide an effective framework for comprehensive evaluation of concept removal methods in the future.

Weaknesses
- Even though the two conceptual models are intuitive and easy to understand, this paper could benefit from deeper analysis and theoretical modeling of them. For example, what is the essential difference between guidance-based avoidance and destruction-based removal? If the target concept is always avoided in generation, can we also say it is a kind of reduction in its likelihood?
- This paper stops by identifying limitations of existing methods and fails to propose a better data erasure method. Therefore, I think the novelty is limited to some extent.

QUESTIONS:
See above.

LIMITATIONS:
Yes.
TITLE: Official Review
CLARITY: 3
IMPACT: 2
ORIGINALITY: 2
DATE: 2025-06-29

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes a classification of erasure methods into two categories:\n\n•\tGuidance-based erasure methods, which redirect the model’s generation process away from a target concept, while the to-be-erased concept’s knowledge remains intact within the model’s parameters.\n\n•\tDestruction-based erasure methods, which fundamentally suppress or eliminate the underlying knowledge of a concept from the model, making the concept theoretically irrecoverable.\n\nAnother contribution of the paper is an evaluation framework composed of four distinct evaluation methods:\n\n•\tOptimization-based Probing: Employs previously proposed techniques like Textual Inversion or adversarial attacks to search for adversarial prompts that recover the erased concept.\n\n•\tIn-context Probing: A new evaluation method proposed by the authors. The idea is to provide visual cues—such as inpainting masked images or completing unfinished intermediate diffusion generations—as inputs (with visual hints) to test whether the erased concept can still be generated.\n\n•\tTraining-Free Trajectory Probing: Another new evaluation method, which manipulates the diffusion process by adding noise to intermediate steps. As described in Appendix B, this is done by modifying the scaling factor $\\eta$ in the random noise component in DDIM.\n\n•\tDynamic Concept Tracing: Measures the distance between CLIP embeddings of images generated by the original model and the erased one (Section 3.4, Fig. 5). The authors claim that “Gradient Ascent and Task Vector—two destruction-based methods”—tend to generate more consistent replacements for the erased concepts, while guidance-based methods like ESD produce more varied outputs. However, the illustration in Fig. 6 and results in Fig. 5 seem to suggest the opposite. More specifically, in rows 2 and 3, the outputs from ESD converge stably to \"a man,\" while rows 1 and 4 exhibit increasingly varied outputs. In Fig. 5, the centroid deviation for GA and TV increases over time, whereas that for ESD converges, which also aligns with the visualizations in Fig. 6.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**\n\n•  The paper is well written.\n\n•  I particularly appreciate the idea of using in-context examples (Section 3.2) to provide visual cues for probing the generation capabilities or memory of the erased concepts. Overall, the Section 3 is well written and provide a comprehensive evaluation framework for evaluating concept unlearning.\n\n**Weaknesses**\n\n- Figure 1, while intuitive, may be misleading to me. Specifically, it is unclear or unconvincing why the redirection arrow (black arrow in the middle and right subfigures) should necessarily lead to a nearby concept. This redirection only makes sense if the erasure method—like ESD or UCE—explicitly forces the to-be-erased concept toward a targeted nearby concept, as done in [1], i.e., $\\epsilon(c_e) \\rightarrow \\epsilon(c_t)$ where $c_t \\in B(c_e)$. In standard erasure methods like ESD, UCE, RECE, or STEREO, where the target concept is not explicitly defined and where general or neutral concepts (e.g., “a photo,” an empty string “ ”, or something like “man” or “human”) are used instead, there is no guarantee that the redirected concept will be semantically nearby. \n\n[1] Fantastic Targets for Concept Erasure in Diffusion Models and Where to Find Them\n\n- The use of Textual Inversion (TI) can be highly sensitive to the amount and type of fine-tuning data. With a small number of reference images, TI may not perform well. However, with enough reference images, TI can learn personal or specific concepts—even if those have been erased.\n\n- Another concern is the definition of “concept”, which can be ambiguous. For example, a concept like “an astronaut monkey” may not appear in the training data but can still be generated by the model based on the core concepts of “astronaut” and “monkey.” Similarly, abstract or nuanced concepts such as “nudity” or artistic styles, though complex, may still be reconstructed from more basic elements (e.g., “human body,” “human skin”). Thus, I believe that achieving complete destruction (as claimed in destruction-based removal) may be unrealistic. This is supported by the results in Table 1: GA, labeled as a destruction-based method, can still regenerate the erased concept using Textual Inversion. I suspect that with a large enough reference dataset, TI would recover the concept even more effectively. Therefore, while the modeling distinction between guidance-based and destruction-based removal is conceptually useful, I believe most current methods—including those labeled as destruction-based—are closer to guidance-based in practice.\n\nQUESTIONS:\n-\tWhile I like the idea of in-context examples (Section 3.2), I couldn't understand how this module is implemented from the description in the paper. Specifically, in Appendix C.5.4 (Inpainting), it is mentioned that “the inpainting pipeline was based on SD v1.5 and implemented via SDInpaintPipeline.” Does this mean the authors applied unlearning to the inpainting model, rather than to the standard text-to-image SD model?\n\n-\tI don’t understand the discussion in Section 3.4 (Dynamic Concept Tracing). The authors state that “Gradient Ascent and Task Vector—two destruction-based methods—tend to generate more consistent replacements for the erased concepts, while guidance-based methods like ESD produce more varied outputs.” However, Fig. 6 and Fig. 5 seem to indicate the opposite. In rows 2 and 3, the outputs from ESD stably converge to “a man,” while rows 1 and 4 exhibit more variation. In Fig. 5, the centroid deviation of GA and TV increases over time, whereas that of ESD decreases. These results seem inconsistent with the authors' claims.\n\n-\tWhat is the target concept used in the experiments in Section 3.4 for the ESD-x and ESD-u methods? In my experience with ESD, the replacement output is strongly influenced by the choice of target concept, and typically will not default to “a man” unless that is explicitly defined as the target in the objective function.\n\n-\tIn Training-Free Trajectory Probing, the authors propose adding noise to the intermediate latent $x$. What would happen if noise were added to the guidance signal instead (e.g., by perturbing the conditional signal $\\tau(y) + \\text{noise}$ or the classifier-free guidance signal $(\\epsilon(\\tau(y)) - \\epsilon(\\tau(\\text{null})))$)?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper investigates whether concept erasure *actually* removes the latent concepts or merely suppress their likelihood of generation through gradient redirection during diffusion. This is formalized as (1) guidance-based avoidance and  (2) destruction-based removal. To answer the four RQs, the authors compile an evaluation suite comprising optimization-based probing (textual inversion, adversarial attacks), in-context probing (inpainting, diffusion completion), training-free trajectory probing (noise injection), and dynamic concept tracing during erasure. This is applied to seven seven methods and 13 concepts — 10 objects and 3 artistic  styles — highlighting that these methods are usually robust on one of the defined types of erasure but struggle on the other.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. New Conceptual Framework. The distinction between guidance-based avoidance and destruction-based remova is a really valuable theoretical grounding for the community and future work in this direction.\n2. Comprehensive Evaluation Suite.\n3. Practical Insights. The finding that methods, which may appear quite robust under adversarial attacks can still be vulnerable to context-based probes (tab 2, fig 3), has important implications for deployment of erasing methods.\nWeaknesses:\n1. Limited Scope of Concepts. The evals cover 13 concepts (10 objects and 3 art styles), which may not generalize to some more complex concepts or larger domains of objects. The authors acknowledge this limitation (Section 5, lines 267-269). Though, it’s not clear to me why, instead of so many single objects, the authors did not choose to explore this.\n2. Validation of the Theoretical Framework: While the two modes of erasure proposed here seem intuitive, the paper would benefit from more support of this categorization. The assignment of methods to categories appears somewhat post-hoc based on empirical performance rather than principled analysis of the underlying mechanisms.\n3. Trade-off Analysis. While the paper mentions the trade-off between erasure thoroughness and preservation of unrelated concepts (lines 45-46, 123-124), this aspect could, perhaps, benefit from a more quantitative analysis.\n4. Noise-Based Probing Limitations: The theoretical justification for the noise-based probe (app B) relies on some strong assumptions (partial latent retention and specific SDE formulations). The proof sketch appears limited to me compared to other probing methods (tab 3).\n5. Prior Work. The issues with existing concept erasure methods have been identified before, and I would hence suggest the following citations: https://arxiv.org/pdf/2502.13989v1 https://dl.acm.org/doi/10.1145/3635636.3664268 https://arxiv.org/abs/2502.14896\n\nQUESTIONS:\n1. Method Categorization. How do you determine ig a method is guidance- or destruction-based a priori, rather than post-hoc based on empirical performance? Could you provide more principled criteria or theoretical analysis to validate this categorization?\n\n2. Scalability to Harmful Content: How would your framework perform on concepts that are often used as motivation for the existance of concept erasure (e.g., explicit content or copyrighted material)?\n\nLIMITATIONS:\nYes, the authors adequately address limitations in Section 5, acknowledging the restricted concept scope, causality issues in concept erasure, and the potential need for additional conceptual models. The broader impact section (app A) appropriately discusses both positive applications and potential misuse concerns. However, the authors could strengthen this by discussing the computational overhead of their evaluation framework and potential limitations in scalability to production systems.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}