A system for removing a concept from a trained neural network (700, 800, 900) for executing a classification task on an input corrupted data item, wherein the input corrupted data item is an image or video, and an output of the classification task is a classification of an object present in the image or video, the system comprising: the trained neural network (700, 800, 900), wherein the trained neural network (700, 800, 900) comprises a hidden layer (720, 820); and a plurality of classifiers respectively incorporated in a plurality of layers of the hidden layer (720, 820), wherein: the hidden layer (720, 820) comprises a plurality of contracting layers and respectively a plurality of layers preceding the contracting layers, wherein the plurality of contracting layers have smaller dimensions than the plurality of layers preceding the contracting layers; the plurality of classifiers are respectively incorporated in the plurality of layers preceding the contracting layers; each classifier defines a representation vector at the layer of the hidden layer (720, 820), wherein the concept is relevant to the classification task and the representation vector classifies instances of the concept and non-instances of the concept at the layer; each classifier defines a concept activation vector, wherein the concept activation vector is a normal vector to the representation vector and the concept activation vector comprises an adversarial penalty objective to reduce the instances of the concept at the layer; and a loss function of the trained neural network (720, 820) is optimised based on a downstream loss of the classification task and the adversarial penalty objective. the trained neural network (700, 800, 900), wherein the trained neural network (700, 800, 900) comprises a hidden layer (720, 820); and a plurality of classifiers respectively incorporated in a plurality of layers of the hidden layer (720, 820), wherein: the hidden layer (720, 820) comprises a plurality of contracting layers and respectively a plurality of layers preceding the contracting layers, wherein the plurality of contracting layers have smaller dimensions than the plurality of layers preceding the contracting layers; the plurality of classifiers are respectively incorporated in the plurality of layers preceding the contracting layers; each classifier defines a representation vector at the layer of the hidden layer (720, 820), wherein the concept is relevant to the classification task and the representation vector classifies instances of the concept and non-instances of the concept at the layer; each classifier defines a concept activation vector, wherein the concept activation vector is a normal vector to the representation vector and the concept activation vector comprises an adversarial penalty objective to reduce the instances of the concept at the layer; and a loss function of the trained neural network (720, 820) is optimised based on a downstream loss of the classification task and the adversarial penalty objective. the hidden layer (720, 820) comprises a plurality of contracting layers and respectively a plurality of layers preceding the contracting layers, wherein the plurality of contracting layers have smaller dimensions than the plurality of layers preceding the contracting layers; the plurality of classifiers are respectively incorporated in the plurality of layers preceding the contracting layers; each classifier defines a representation vector at the layer of the hidden layer (720, 820), wherein the concept is relevant to the classification task and the representation vector classifies instances of the concept and non-instances of the concept at the layer; each classifier defines a concept activation vector, wherein the concept activation vector is a normal vector to the representation vector and the concept activation vector comprises an adversarial penalty objective to reduce the instances of the concept at the layer; and a loss function of the trained neural network (720, 820) is optimised based on a downstream loss of the classification task and the adversarial penalty objective.