Erasing Undesirable Concepts in Diffusion Models with Adversarial Preservation

Authors: anh  bui
long  vuong
khanh  doan
trung  le
paul  montague
tamas  abraham
dinh  phung
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-15 11:13:47

Abstract: Diffusion models excel at generating visually striking content from text but can inadvertently produce undesirable or harmful content when trained on unfiltered internet data. A practical solution is to selectively removing target concepts from the model, but this may impact the remaining concepts. Prior approaches have tried to balance this by introducing a loss term to preserve neutral content or a regularization term to minimize changes in the model parameters, yet resolving this trade-off remains challenging. In this work, we propose to identify and preserving concepts most affected by parameter changes, termed as *adversarial concepts*. This approach ensures stable erasure with minimal impact on the other concepts. We demonstrate the effectiveness of our method using the Stable Diffusion model, showing that it outperforms state-of-the-art erasure methods in eliminating unwanted content while maintaining the integrity of other unrelated elements. Our code is available at \url{https://github.com/tuananhbui89/Erasing-Adversarial-Preservation}.

Main paper: 
 introduction: 
 Recent advances in text-to-image diffusion models (Rombach et al., 2022; Ramesh et al., 2021 Ramesh et al., , 2022) ) have captured significant attention thanks to their outstanding image quality and boundless creative potential. These models undergo training on extensive internet datasets, enabling them to capture a wide range of concepts, which inevitably include undesirable concepts such as racism, sexism, and violence. Hence, these models can be exploited by users to generate harmful content, contributing to the proliferation of fake news, hate speech, and disinformation (Rando et al., 2022; Qu et al., 2023; Westerlund, 2019) . Removing these undesirable contents from the model's output is thus a critical step in ensuring the safety and usefulness of these models.Addressing this challenge, several methods have been proposed to erase undesirable concepts from pretrained text-to-image models, such as TIME (Orgad et al., 2023) , UCE (Zhang et al., 2023) , Concept Ablation (Kumari et al., 2023) , and ESD (Gandikota et al., 2023) . Despite differing approaches, these methods reach a common finding: removing even one concept can significantly reduce the model's ability to generate other concepts. This is because large-scale generative models G : C → X , such as Stable Diffusion (StabilityAI, 2022) , are trained on billions of image-text pairs (x, c), where x is an image and c is its caption, implicitly containing a set of concepts. The concept space is thus vast and intricately entangled within the model's parameters, meaning no specific part of the model's weights is solely responsible for a single concept. Consequently, the removal of one concept alters the entire model's parameters, causing a decline in overall performance. To address this degradation, existing methods typically select a neutral concept, such as "a photo" or an empty string, as an anchor to preserve while erasing the target concept, expecting that maintaining the neutral concept should help retain other concepts as well Orgad et al. (2023) ; Gandikota et al. (2024) .While choosing a neutral concept is reasonable, we argue that it is not the optimal choice and may not guarantee the preservation of the model performance. In this paper, we propose to shift the attention towards the adversarial concepts, those most affected by changes in model parameters. This approach ensures that erasing unwanted content is stable and minimally impacts other concepts. To summarize, our key contributions are two-fold:• We empirically investigate the impact of unlearning the target concept on the generation of other concepts. Our findings show that erasing different target concepts affects the remaining ones in various ways. This raises the question of whether preserving a neutral concept is sufficient to maintain the model's capability. We discover that the neutral concept lies in the middle of the sensitivity spectrum, whereas related concepts such as "person" and "women" are more sensitive to the target concept "nudity" than many neutral concepts. Additionally, we demonstrate that selecting the appropriate concepts to preserve significantly improves quality retention.• We propose a novel method to identify the most sensitive concepts corresponding to the concept targeted to be erased, and then preserve these sensitive concepts explicitly to maintain the model's capability. We then conduct extensive experiments that demonstrate that the proposed method consistently outperforms other approaches in various settings.2 Background of Text-to-Image Diffusion ModelsDenoising Diffusion Models: Generative modeling is a fundamental task in machine learning that aims to approximate the true data distribution p data from a dataset D = {x i } N i=1 . Diffusion models, a recent class of generative models, have shown impressive results in generating high-resolution images (Ho et al., 2020; Rombach et al., 2022; Ramesh et al., 2021 Ramesh et al., , 2022)) . In a nutshell, training a diffusion model involves two processes: a forward diffusion process where noise is gradually added to the input image, and a reverse denoising diffusion process where the model tries to predict a noise ϵ t which is added in the forward process. More specifically, given a chain of T diffusion steps x 0 , x 1 , ..., x T , the denoising process can be formulated as follows: p θ (x T :0 ) = p(x T )1 t=T p θ (x t-1 | x t ).The model is trained by minimizing the difference between the true noise ϵ and ϵ θ (x t , t), the predicted noise at step t by the denoising model θ as follows:L = E x0∼pdata,t,ϵ∼N (0,I) ∥ϵ -ϵ θ (x t , t)∥ 2 2(1) Latent Diffusion Models: With an intuition that semantic information that controls the main concept of an image can be represented in a low-dimensional space, (Rombach et al., 2022) proposed a diffusion process operating on the latent space to learn the distribution of the semantic information which can be formulated as p θ (z T :0 ) = p(z T ) 1 t=T p θ (z t-1 | z t ), where z 0 ∼ ε(x 0 ) is the latent vector obtained by a pre-trained encoder ε.L = E z0∼ε(x),x∼pdata,t,ϵ∼N (0,I) ∥ϵ -ϵ θ (z t , t)∥ 2 2(2) 
problem statement: 
 The task of erasing concepts from a text-to-image diffusion model often appears without additional data or labels, forcing us to rely on the model's own knowledge. Therefore, we here consider fine-tuning a pre-trained model rather than training a model from scratch. Let ϵ θ (z t , c, t) denote the output of the pre-trained foundation U-Net model parameterized by θ at step t given an input description c ∈ C and the latent vector from the previous step z t where C is set of all possible input descriptions, commonly referred to as the textual prompt in text-to-image generative models.Given a set of textual descriptions E ⊂ C and the target model ϵ θ , our objective is to learn a sanitized model ϵ θ ′ (z t , c, t) that cannot generate images from any textual description c ∈ E while preserving the quality of images generated by the remaining concepts R = C \ E. We also use c n to denote a neutral or null concept, i.e., "a photo" or " ". Figure 1 : Analysis of the impact of erasing the target concept on the model's capability. The impact is measured by the difference of CLIP score δ(c) between the original model and the corresponding sanitized model. 1a: Impact of erasing "nudity" or "garbage truck" to other concepts. 1b: Comparing the impact of erasing the same "garbage truck" to other concepts with different preserving strategies, including preserving a fixed concept such as " ", "lexus", or "road", and adaptively preserving the most sensitive concept found by our method.A naive approach that has been widely used in previous works Gandikota et al. (2023) ; Orgad et al. (2023) ; Gandikota et al. (2024) is to optimize the following objective function:min θ ′ E ce∈E ∥ϵ θ ′ (c e ) -ϵ θ (c n )∥ 2 2(3)Fundamentally, these methods aim to force the model output, associated with the to-be-erased concepts, to approximate the model output associated with a neutral or null input c n (e.g., "a photo" or " "). Ideally, when erasing a concept, we would like to preserve all the remaining ones. This would corresponding to optimizing the above objective for all possible concepts in C \ E, which is excessively expensive. Hence, using a neutral concept as proxy first seems as a convenient strategy.While this naive approach is effective in erasing the specific concept, it however has a negative impact on the model's capacity to preserve other concepts related to the to-be-erased concepts. For example, easing the concept "nudity" affects the quality of images of "woman" or "person". To mitigate this issue, prior works have proposed to use either an additional loss term to retain the null concept Gandikota et al. (2023) or a regularization term to prevent excessive change in the model parameters Orgad et al. (2023) . However, these regularization attempts clearly have not addressed the core trade-off between erasing a concept and preserving the others.We here approach the problem more carefully via a study on the impact of erasing a specific concept on model performance on the remaining ones. More importantly, we are concerned with the most sensitive concepts to erasure. For example, when removing the concept of "nudity", we are curious to know which concepts change the most in the model's output, so that we can preserve these concepts specifically to ensure the model's capability is maintained, at least with respect to these concepts.For some concepts, we can make an intuitive guess. For example, the concept of "nudity" is closely related to the concepts of "women" and "men", which are likely to be affected by the removal of the concept of "nudity". However, for most concepts, it is not easy to determine which ones are most sensitive to the target concept. Therefore, in prior works, selecting a neutral one like a 'photo' or " " regardless of the target concepts is clearly not a sound solution. We next provide empirical evidence to support this argument.Measuring Generation Capability with CLIP Alignment Score. Given a target concept c e , e.g., "nudity" or "garbage truck", from that we obtain the original model ϵ θ and the sanitized model To achieve this, we generate a large number of samples from both models, i.e., {G(θ, c, z i T )} k i=1 , {G(θ ′ ce , c, z i T )} k i=1 for k =(c) = 1 k k i=1 S θ,i,c -S θ ′ ce ,i,cindicates the impact of unlearning c e on generating the concept c. The discussion on the metric is provided in Appendix B.3.The Removal of Different Target Concepts Leads to Different Side-Effects. Figure 1a shows the impact of the removal of two distinct concepts, "nudity" and "garbage truck", on other concepts, measured by the difference of the CLIP score, δ 'nudity' (c), δ 'garbage truck' (c). A larger δ(c) indicates a greater negative impact on the model's ability to generate concept c.It can be seen that removing the "nudity" concept significantly affects highly related concepts such as "naked", "men", "women", and "person", while having minimal impact on unrelated concepts such as "garbage truck", 'bamboo' or neutral concepts such as "a photo" or the null " " concept. Similarly, removing the "garbage truck" concept significantly reduces the model's capability on concepts like "boat", "car", "bus", while also having little impact on other unrelated concepts such as "naked", "women" or neutral concepts.These results suggest that removing different target concepts leads to varying impacts on other concepts. This indicates the need for an adaptive method to identify the most sensitive concepts relative to a particular target concept, rather than relying on random or fixed concepts for preservation. Moreover, in both cases, neutral concepts like "a photo" or the null concept show resilience and independence from changes in the model's parameters, suggesting that they do not adequately represent the model's capability to be preserved.Neutral Concepts lie in the Middle of the Sensitivity Spectrum. Figure 2 shows the distribution of similarity scores between the outputs of the original model θ and the sanitized model θ ′ ce for each concept c from the CLIP tokenizer vocabulary. The histogram reveals that the similarity scores span a wide range, indicating that the impact of unlearning the target concept on generating other concepts varies significantly. The lower the similarity score, the more different the outputs of the two models are, and the more sensitive the concept is to the target concept. Notably, the more related concepts like "women" or "men" are more sensitive to the removal of "nudity" than many neutral concepts that lie in the middle of the sensitivity spectrum. What Concept should be Kept to Maintain Model Performance. Figure 1b presents the results of an experiment similar to the previous one, with one key difference: we utilize the prior knowledge gained from the previous experiment. Specifically, when erasing the "garbage truck", we apply different preservation strategies, including preserving a fixed concept such as " ", "lexus", or "road", and adaptively preserving the most sensitive concept found by our method.The results show that with simple preservation strategies such as preserving a fixed but related concept like "road", the model's capability on other concepts is better maintained compared to preserving a neutral concept. However, the results of adaptively preserving the most sensitive concept show the best performance, with the least side effects on other concepts. Similarly, the results of erasing the "nudity" concept as shown in Figure 3 show that preserving related concepts like "person" helps retain the model's capability on other concepts much better than preserving a neutral concept. These findings confirm the importance of selecting sensitive concepts to preserve in order to better maintain the model's overall capability. 
proposed method: adversarial concept preservation: 
 In this work, we aim to minimize the side effects of erasing undesirable concepts in diffusion models through adversarial preservation. Motivated by the observations in the previous section, our approach involves identifying the most sensitive concepts related to a specific target concept. For example, when removing the concept of nudity, we identify which concepts are most affected in the model's output so that we can specifically preserve these concepts to ensure the model's capability is maintained.In each iteration, before updating the model parameters, we first identify the concept c a that is most sensitive to changes in the model parameters as we work to remove the target concepts.min θ ′ max ca∈R E ce∈E   ∥ϵ θ ′ (c e ) -ϵ θ (c n )∥ 2 2 L1 +λ ∥ϵ θ ′ (c a ) -ϵ θ (c a )∥ 2 2 L2    (4)where λ > 0 is a parameter and R = C \ E denotes the remaining concepts.Objective loss L 1 is the same as in the naive approach, aiming to erase the target concept c e by forcing its output to match that of a neutral concept. Our main contribution lies in the introduction of the adversarial preservation loss L 2 , which aims to identify the most sensitive concept c a that is most affected by changes in the model parameters when removing the target concepts.Since the concepts exist in a discrete space, the straightforward approach would involve revisiting all concepts in R, resulting in significant computational complexity. Another naive approach is to consider the concepts as lying in a continuous space and use the Projected Gradient Descent (PGD) method, similar to Madry et al. (2017) , to search within the local region of the continuous space of the concepts. More specifically, we initialize the adversarial prompt with the text embedding of the to-be-erased concept, e.g., c a,0 = c e = τ ("Garbage Truck"), and then update the adversarial concept with gradient ∇ ca L 2 . Interestingly, while this approach provides an efficient computational method, we find that the adversarial concept quickly collapses from the initial concept to a background concept with the color information of the object as shown in the first row of Figure 4 .To combine the benefits of both approaches-making the process continuous and differentiable for efficient training while achieving meaningful concepts that are related to the target concept (second row of Figure 4 )-we first define a distribution over the discrete concept embedding vector space as P R,π = |R| i=1 π i δ ei with the Dirac delta function δ and the weights π ∈ ∆ R = {π ′ ≥ 0 : ∥π ′ ∥ 1 = 1}. Instead of directly searching for the most sensitive concept c a in the discrete concept embedding vector space R, we switch to searching for the embedding distribution π on the simplex ∆ R and subsequently transform it back into a discrete space using the temperature-dependent GumbelSoftmax trick (Jang et al., 2016; Maddison et al., 2016) as follows:min θ ′ max π∈∆ R E ce∈E   ∥ϵ θ ′ (c e ) -ϵ θ (c n )∥ 2 2 L1 +λ ∥ϵ θ ′ (G(π) ⊙ R) -ϵ θ (G(π) ⊙ R)∥ 2 2 L2    (5)where λ > 0 is a parameter, G is Gumbel-Softmax operator and ⊙ is element wise multiplication operator. The pseudo-algorithm involves a two-step optimization process, outlined in Algorithm 1: Finding Adversarial Concept and Algorithm 2: Adversarial Erasure Training.Algorithm 1 Find Adversarial ConceptInput: θ, R. Searching hyperparameters: η, N iter . Current state θ ′ k Output: Adversarial concept c a for i = 1 to N iter do π ← π + η∇ π ∥ϵ θ ′ (G(π) ⊙ R) -ϵ θ (G(π) ⊙ R)∥ 2 2 ▷ Maximize L 2 end for c a = G(π * ) ⊙ R 
experiments: 
 In this section, we present a series of experiments to evaluate the effectiveness of our method in erasing various types of concepts from the foundation model. Our experiments use Stable Diffusion (SD) version 1.4 as the foundation model. We maintain consistent settings across all methods: finetuning the model for 1000 steps with a batch size of 1, using the Adam optimizer with a learning rate of α = 10 -5 . We benchmark our method against four baseline approaches: the original pre-trained SD model, ESD (Gandikota et al., 2023) , UCE (Gandikota et al., 2024) , and Concept Ablation (CA) (Kumari et al., 2023) .Algorithm 2 Adversarial Erasure Training Input: θ, R, E, λ. Searching hyperparameters: η, N iter . Output: θ ′ k ← 0, θ ′ k ← θ while Not Converged do c e ∼ E c a ← FindAdversarialConcept(θ ′ k , θ, R, η, N iter ) θ ′ k+1 ← θ ′ k -α∇ θ ′ [∥ϵ θ ′ (c e ) -ϵ θ (c n )∥ 2 2 + λ ∥ϵ θ ′ (c a ) -ϵ θ (c a )∥ 2 2 ]▷ Outer min end whileWe provide detailed implementation and further in-depth analysis in the appendix, including qualitative results (Section C), the choice of hyperparameters (Section B.2), and analysis on the search for the adversarial concepts (Sections B.4 and B.5).In this experiment, we investigate the ability of our method to erase object-related concepts from the foundation model, for example, erasing entire object classes such as "Cassette Player" from the model. We choose Imagenette1 which is a subset of the ImageNet dataset Deng et al. (2009) which comprises 10 easily recognizable classes, including "Cassette Player", "Chain Saw", "Church", "Gas Pump", "Tench", "Garbage Truck", "English Springer", "Golf Ball", "Parachute", and "French Horn".Since the erasing performance when erasing a single class has been the main focus of previous work Gandikota et al. (2023) , we choose a more challenging setting where we erase a set of 5 classes simultaneously. Specifically, we generate 500 images for each class and employ the pre-trained ResNet-50 He et al. (2016) to detect the presence of an object in the generated images. We use the two following metrics to evaluate the erasing performance: Erasing Success Rate (ESR-k):The percentage of all the generated images with "to-be-erased" classes where the object is not detected in the top-k predictions. Presevering Success Rate (PSR-k): The percentage of all the generated images with all other classes (i.e., "to-be-preserved") where the object is detected in the top-k predictions. This dual-metric evaluation provides a comprehensive assessment of our method's ability to effectively erase targeted object-related concepts while also preserving relevant elements.Quantitative Results. We select four distinct sets of 5 classes from the Imagenette set for erasure and present the outcomes in Table 1 . First, we note that the average PSR-1 and PSR-5 scores across the four settings of the original SD model stand at 78.0% and 97.6%, respectively. These scores indicate that 78.0% of the generated images contain the object-related concepts which are subsequently detected in the top-1 prediction, and when checking the concepts in any of the top-5 predictions, this number increases to 97.6%. This underscores the original SD model's ability to generate images with the anticipated object-related concepts.In term of erasing performance, it can be observed that all baselines achieve very high ESR-1 and ESR-5 scores, with the lowest ESR-1 and ESR-5 scores being 95.5% and 88.9% respectively. This indicates the effectiveness of these methods to erase object-related concepts, as only a very small proportion of the generated images contain the object-related concepts under subsequent detection. Notably, the UCE method can achieve 100% ESR-1 and ESR-5, which is the highest among the baselines. Our method achieves 98.6% ESR-1 and 96.1% ESR-5, which is much higher than the two baselines ESD and CA, and only slightly lower than the UCE method, which is designed specifically for erasing object-related concepts.However, despite the high erasing performance, the baselines, especially UCE, suffer from a significant drop in preserving performance, with the lowest PSR-1 and PSR-5 scores being 23.4% and 49.5%, respectively. This suggests that the preservation task poses greater challenges than the erasing task, and the baselines are ineffective in retaining other concepts. In contrast, our method achieves 55.2% PSR-1 and 79.9% PSR-5, which is a significant improvement compared to the best baseline, CA, with 44.2% PSR-1 and 66.5% PSR-5. This result underscores the effectiveness of our method in simultaneously erasing object-related concepts while preserving other unrelated concepts. One of the serious concerns associated with the deployment of text-to-image generative models to the public domain is their potential to generate Not-Safe-For-Work (NSFW) content. This ethical challenge has become a primary focus in recent works Schramowski et al. (2023) ; Gandikota et al. (2023 Gandikota et al. ( , 2024)) , aiming to sanitize such capability of the model before public release.In contrast to object-related concepts, such as "Cassette Player" or "English Springer", which can be explicitly described with limited textual descriptions, i.e., there are only a few textual ways to describe the visual concepts, unethical concepts like nudity are indirectly expressible in textual descriptions.The multiple ways a single visual concept can be described make erasing such concepts challenging, especially when relying solely on a keyword to indicate the concept to be erased. As empirically shown in Gandikota et al. (2023) , the erasing performance on these concepts is highly dependent on the subset of parameters that are finetuned. Specifically, fine-tuning the non-cross-attention modules has shown to be more effective than fine-tuning the cross-attention modules. Therefore, in this experiment, we follow the same configuration as in Gandikota et al. (2023) , focusing exclusively on fine-tuning the non-cross-attention modules.Quantitative Results. To generate NSFW images, we employ I2P prompts Schramowski et al. (2023) and generate a dataset comprising 4703 images with attributes encompassing sexual, violent, and racist content. We then utilize the detector Praneet ( 2019) which can accurately detect several types of exposed body parts to recognize the presence of the nudity concept in the generated images.The detector Praneet (2019) provides multi-label predictions with associated confidence scores, allowing us to adjust the threshold and control the trade-off between the number of detected body parts and the confidence of the detection, i.e., the higher the threshold, the fewer the number of detected body parts.Figure 5a illustrates the ratio of images with any exposed body parts detected by the detector Praneet (2019) over the total 4703 generated images (denoted by NER) across thresholds ranging from 0.3 to 0.8. Notably, our method consistently outperforms the baselines under all thresholds, showcasing its effectiveness in erasing NSFW content. In particular, as per Table 2 , with the threshold set at 0.3, the NER score for the original SD model stands at 16.7%, indicating that 16.7% of the generated images contain signs of nudity concept from the detector's perspective. The two baselines, ESD and UCE, achieve 5.32% and 6.87% NER with the same threshold, respectively, demonstrating their effectiveness in erasing nudity concepts. Our method achieves 3.64% NER, the lowest among the baselines, indicating the highest erasing performance. This result remains consistent across different thresholds, emphasizing the robustness of our method in erasing NSFW content. Additionally, to measure the preserving performance, we generate images with COCO 30K prompts and measure the FID score compared to COCO 30K validation images. Our method achieves the best FID score of 15.52, slightly lower than that of UCE, which is the best baseline at 15.98, indicating that our method can simultaneously erase a concept while preserving other concepts effectively.Detailed statistics of different exposed body parts in the generated images are provided in Figure 5b .It can be seen that in the original SD model, among all the body parts, the female breast is the most detected body part in the generated images, accounting for more than 320 images out of the total 4703 images. Both baselines, ESD and UCE, as well as our method, achieve a significant reduction in the number of detected body parts, with our method achieving the lowest number among the baselines. Our method also achieves the lowest number of detected body parts for the most sensitive body parts, only surpassing the baseline for less sensitive body parts, such as feet.Interestingly, our method seems to remove the sensitive body parts while keeping the less sensitive body parts untouched as shown in Figure 5b . To provide more insights into this phenomenon, we calculate the similarity scores between different concepts and body parts in the nudity erasure setting as Table 3 . It can be seen that the "nudity" concept is highly correlated with the "Female Breast" concept, suggesting that when removing the "nudity" concept, the "Female Breast" concept is more likely to be affected than other body parts. On the other hand, the "Person" or "Body" concept is more strongly correlated with the "Feet" concept than with the "Female Breast" concept, indicating that preserving the "Person" concept might help maintain the model's performance on "Feet" rather than on "Female Breast." Furthermore, the gap between the "Feet" and "Female Breast" concepts with respect to "Person" or "Body" is larger than the gap with more generic concepts like "A photo." This suggests that preserving generic concepts might not have the same impact as preserving the most affected concepts. Our method naturally selects the most affected concepts to be preserved, which often includes concepts highly correlated with non-sensitive body parts. This explains the observed phenomenon in the experiment.In this experiment, we investigate the ability of our method to erase artistic style concepts from the foundation model. We choose several famous artists with easily recognizable styles who have been known to be mimicked by the text-to-image generative models, including "Kelly Mckernan", "Thomas Kinkade", "Tyler Edlin" and "Kilian Eng" as in Gandikota et al. (2023) . We compare our method with recent work including ESD Gandikota et al. (2023) , UCE Gandikota et al. (2024) , and CA Kumari et al. (2023) which have demonstrated effectiveness in similar settings.For fine-tuning the model, we use only the names of the artists as inputs. For evaluation, we use a list of long textual prompts that are designed exclusively for each artist, combined with 5 seeds per prompt to generate 200 images for each artist across all methods. We measure the CLIP alignment score2 between the visual features of the generated image and its corresponding textual embedding. Compared to the setting Gandikota et al. (2023) which utilized a list of generic prompts, our setting with longer specific prompts can leverage the CLIP score as a more meaningful measurement to evaluate the erasing and preserving performance. We also use LPIPS Zhang et al. (2018) to measure the distortion in generated images by the original SD model and editing methods, where a low LPIPS score indicates less distortion between two sets of images.It can be seen from Table 4 that our method achieves the best erasing performance while maintaining a comparable preserving performance compare to the baselines. Specifically, our method attains the lowest CLIP score on the to-be-erased sets at 21.57, outperforming the second-best score of 23.56 achieved by ESD. Additionally, our method secures a 0.78 LPIPS score, the second-highest, following closely behind the CA method with 0.82. Concerning preservation performance, we observe that, while our method achieves a slightly higher LPIPS score than the UCE method, suggesting some alterations compared to the original images generated by the SD model, the CLIP score of our method remains comparable to these baselines. This implies that our generated images still align well with the input prompt.  
conclusion: 
 In this paper, we introduced a novel approach to concept erasure in text-to-image diffusion models by incorporating an adversarial learning mechanism. This mechanism identifies the most sensitive concepts affected by the removal of the target concept from the discrete space of concepts. By preserving these sensitive concepts, our method outperforms state-of-the-art erasure techniques in both erasing unwanted content and preserving unrelated concepts, as demonstrated through extensive experiments. Furthermore, our adversarial learning mechanism exhibits high flexibility, linking this task to the field of Adversarial Machine Learning, where adversarial examples have been extensively studied. This connection opens potential directions for future research, such as simultaneously searching for multiple sensitive concepts under certain divergence constraints, offering promising avenues for further exploration. Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?Answer: [Yes] Justification: Appendix B.1.Guidelines:• The answer NA means that the paper does not include experiments.• The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them. • The full details can be provided either with the code, in appendix, or as supplemental material. 
experiment statistical significance: 
 Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?Answer: [Yes]Justification: Section 5.Guidelines:• The answer NA means that the paper does not include experiments.• The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper. • The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions). • The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.) • The assumptions made should be given (e.g., Normally distributed errors).• It should be clear whether the error bar is the standard deviation or the standard error of the mean. • It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified. • For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates). • If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text. 
experiments compute resources: 
 Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?Answer: [Yes] Justification: Appendix B.1.Guidelines:• The answer NA means that the paper does not include experiments.• The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage. • The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute. • The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper). 
code of ethics: 
 Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines?Answer: [Yes] Justification: Our research does not involve human subjects and we are unaware of any negative societal impact resulting from our work. All datasets used in the experiments are publicly released by their authors and we respect the terms of those that have defined licenses.Guidelines:• The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.• If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction). 
broader impacts: 
 Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?Answer: [NA] Justification: The paper provides a theoretical analysis of the domain generalization problem in machine learning. We are currently unaware of any potential negative societal impacts of our work.Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.• Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations. • The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)? Answer: [NA] Justification: The paper does not release any data or models. Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort. 12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected? Answer: [Yes] Justification: Appendix B.1. Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided. • If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. 
 
 Appendix: Given the growing concerns over the potential misuse of text-to-image models, several techniques have been developed to remove undesirable concepts from foundation models before deployment.The simplest approach is pre-processing, which filters out objectionable content from the training data using pre-trained detectors. This method, as seen in Stable Diffusion v2.0 (StabilityAI, 2022) and Dall-E3 , excludes harmful data from the training set. However, it requires retraining the entire model, making it computationally expensive and impractical for adapting to evolving erasure requests.Another basic approach is post-processing, which aims to identify potentially inappropriate content in generated data and then either blur or black out the images before they are presented to users. This method involves a Not-Safe-For-Work (NSFW) detector, which can be deployed along with the generative model, as seen in closed-source models like Dall-E or Midjourney, or released as a separate module in open-source models like Stable Diffusion. However, this approach is not foolproof, as demonstrated in (Yang et al., 2024) , where a technique similar to the Boundary Attack (Brendel et al., 2017) was used to uncover adversarial prompts that could bypass the filtering mechanism. In the case of open-source models, the NSFW detector can be easily disabled by modifying just a few lines of code in the source (SmithMano, 2022).To date, the most successful strategy for sanitizing open-source models, such as Stable Diffusion, is model fine-tuning, which involves sanitizing the generator (e.g., U-Net) in the diffusion model posttraining on raw, unfiltered data and before public release. This approach, as partially demonstrated in Gandikota et al. (2023 Gandikota et al. ( , 2024)) , underscores the importance of addressing potential biases and undesired content in models before their deployment. There are two main branches within model fine-tuning: attention-based and output-based, categorized by the primary components involved in the objective function.Attention-based methods (Zhang et al., 2023; Orgad et al., 2023; Kumari et al., 2023; Gandikota et al., 2024; Lu et al., 2024) focus on modifying the attention mechanisms within models to remove undesirable concepts. In Latent Diffusion Models (LDMs), for instance, the textual conditions are embedded via a pre-trained CLIP model and injected into the cross-attention layers of the UNet model (Rombach et al., 2022; Ramesh et al., 2022) . Therefore, removing an unwanted concept can be achieved by altering the attention mechanism between the textual condition and visual information flow. For example, in TIME (Orgad et al., 2023) , the authors propose to minimize ∥W ′ c e -v * t ∥ 2 2 , where W represents the original cross-attention weights, W ′ the fine-tuned weights, c e the embedding of the unwanted concept, and v * t the target vector. By different settings of v * t , the method can either steer the unwanted concept toward a more acceptable one (i.e., v * t = W τ ("a photo")) or edit biases in the model (i.e., v * t = W τ ("a female doctor")). This category has two main advantages including the closed-form solution as shown in (Orgad et al., 2023) , and the fact that it operates solely on textual embeddings not the intermediate images, making it faster than optimization-based methods.Follow-up works (Zhang et al., 2023; Gandikota et al., 2024; Lu et al., 2024) share this principle. Specifically, Forget-Me-Not (Zhang et al., 2023) introduces an attention resteering method that minimizes the L2 norm of the attention maps related to the unwanted concept. UCE (Gandikota et al., 2024) extends TIME by proposing a preservation term that allows the retention of certain concepts while erasing others. MACE (Lu et al., 2024) improves the generality and specificity of concept erasure by employing LoRA modules (Hu et al., 2021) for each individual concept, combining them with the closed-form solution from TIME (Orgad et al., 2023) .Output-based methods (Gandikota et al., 2023; Bui et al., 2024) focus on optimizing the output image by minimizing the difference between the predicted noise ϵ θ ′ (z t , t, c e ) and the target noise ϵ θ (z t , t, c t ). Unlike attention-based methods, this approach requires intermediate images z t sampled at various time steps t during the diffusion process. While this method is computationally more expensive, it generally yields superior erasure results by directly optimizing the image, ensuring the removal of unwanted concepts (Gandikota et al., 2023) .A recent addition to the field, SPM (Lyu et al., 2024) , introduces one-dimensional adapters that, when combined with pre-trained LDMs, prevent the generation of images containing unwanted concepts. SPM introduces a new diffusion process ε = ϵ(x t , c t | θ, M ce ), where M ce is an adapter model trained to remove the undesirable concept c e . While these adapters can be shared and reused across different models, the original model θ remains unchanged, allowing malicious users to remove the adapter and generate harmful content. Thus, SPM is less robust and practical compared to the other approaches discussed.Concept mimicry is a recent research direction that aims to copy or mimic a specific concept from a set of reference images to generate new images containing the concept. The concept can be artistic styles or personal visual appearance, raising concerns about the potential misuse of the technique. Noteworthy methods include Textual Inversion (Gal et al., 2022) and Dreambooth (Ruiz et al., 2023) , which have proven effective with just a few user-provided images. In contrast, Anti Concept Mimicry is employed to safeguard personal or artistic styles from being copied through concept mimicry. Achieved by introducing imperceptible adversarial noise to input images, this technique can deceive concept mimicry methods under specific conditions. Recent contributions such as Anti-Dreambooth (Van Le et al., 2023) , SDS (Xue et al., 2023) , and MetaCloak (Liu et al., 2024) have explored and demonstrated the effectiveness of this approach. EditGuard (Zhang et al., 2024a) , on the other hand, aims to watermark images with imperceptible adversarial noise to localize tampered regions and claim copyright protection. This category can be viewed as a protection method from the user's side, which is orthogonal to the erasure problem discussed in this paper.Developed concurrently with this paper, AdvUnlearn (Zhang et al., 2024b) incorporates adversarial training (Goodfellow et al., 2014; Madry et al., 2017; Bui et al., 2020 Bui et al., , 2022) ) to improve the robustness of concept erasure. More specifically, the authors propose a similar bilevel min-min optimization problem, where the inner minimization problem seeks to find the adversarial prompt c a that minimizes the attack loss, i.e., the extent to which the unwanted concept is retained in the generated image. The adversarial prompt c a is found using adversarial prompt attack techniques (Zhang et al., 2025; Chin et al., 2023) , such as the fast gradient sign method (FGSM) (Goodfellow et al., 2014) .While both AdvUnlearn and our approach share the adversarial training framework, they are fundamentally different. Firstly, our method is driven by the observation of how erasure impacts model performance and how different preservation strategies affect erasure efficacy. AdvUnlearn, on the other hand, is motivated by adversarial prompt attacks. Secondly, our method formulates the problem as a bilevel min-max optimization, where the inner maximization aims to find the adversarial concept c a that maximizes the preservation loss, while AdvUnlearn's inner minimization seeks the adversarial prompt c * that minimizes the attack loss. Finally, our method employs the Gumbel-Softmax trick (Jang et al., 2016) to approximate the bilevel optimization, whereas AdvUnlearn uses FGSM to find the adversarial prompt.General Settings. Our experiments use Stable Diffusion (SD) version 1.4 as the foundation model. We maintain consistent settings across all methods, fine-tuning the model for 1000 steps with a batch size of 1, using the Adam optimizer with a learning rate of 1e-5. We benchmark our method against four baseline approaches: the original pre-trained SD model, ESD (Gandikota et al., 2023) , UCE (Gandikota et al., 2024) , and Concept Ablation (CA) (Kumari et al., 2023) . Our models are trained on 1 NVIDIA A100 GPUs of 80GB. One training routine takes less than 6 hours for erasing "nudity" and less than 1 hour for other concepts.Settings for Our Method. A crucial aspect of our method is the concept space R, where we search for the most sensitive concept c a . In our experiments, we use two vocabularies: the CLIP token vocabulary, which includes 49,408 tokens, and the Oxford 3000 word list, comprising the 3000 most common English words4 . While the CLIP token vocabulary is more comprehensive, it presents challenges due to the large number of nonsensical tokens. Therefore, for the experiments in Section 5, we use the Oxford 3000-word list to demonstrate the effectiveness of our method.Computational Limitations. To search for the adversarial concept c a effectively, we employ the Gumbel-Softmax trick (Jang et al., 2016) to sample from the categorical distribution in the concept space R. This approach requires feeding the model with the embeddings of the entire concept space R, which exponentially increases the computational cost as the size of the concept space grows.To mitigate this, we use a subset of the K most similar concepts to the target concept c e to reduce computational costs. The similarity between concepts is calculated using cosine similarity between their embeddings.To provide a better understanding of the concept space R, we list the K most similar concepts to the target concept c e in Table 5 . We provide the study of the impact of the number of concepts K and the number of search steps N iter on the erasing and preservation performance in Section B. It is worth to remind that, erasing "nudity" requires to fine-tune on all non-cross-attention modules which is more computationally expensive than erase other concepts that only requires fine-tuning on cross-attention modules. Therefore, in the default settings, we use K = 50 for erasing 'nudity' and K = 100 for other concepts. For searching hyperparameters, we use N iter = 2, η = 1 × 10 -3 , and a trade-off λ = 1 as the default settings.In this section, we investigate the impact of hyperparameters on the performance of our method. Specifically, we analyze the effect of the number of closest concepts K and the number of search steps N iter on the erasing and preservation performance. We conduct the experiments on the Imagenette dataset with the same settings as in Section 5. Table 6 shows the evaluation results of different hyperparameter settings. It can be seen that the erasing and preservation performance is more affected by the number of concepts K than the number of search steps N iter . Reducing the search space from K = 100 to K = 20 hugely decreases the erasing performance by around 2% in ESR-1 and 3% in ESR-5, as well as the preservation performance by around 2% in PSR-5. This observation aligns with the intuition that a larger search space provides more flexibility for the model to find the most sensitive concept c a .On the other hand, increasing the number of search steps from N iter = 2 to N iter = 8 does not increase the performance, but inversely hurts the preservation performance by around 10% in PSR-1. Therefore, in other experiments, we use K = 100 and N iter = 2 as the default settings.To ensure the generality of the search space so that it can be applied to various tasks such as object-related concepts, NSFW content, and artistic styles, we used the Oxford 3000 most common words in English as the search space.To evaluate the impact of the concept space, we conduct additional experiments with the search space as the CLIP token vocabulary, which includes 49,408 tokens. It is worth noting that the CLIP token , vehicle, waste, pollution, bus, terrible, container, vegetable, something, awful, refuse, delivery, destruction, that, transportation, another, traffic, engine, grocery, machine, comprehensive, divorce, dirty, interesting, organic, great, opinion, typical, well, yeah, really, stupid, controversy, painful, object, funny, garage, political, sick, neighborhood, sentence, deliver, interpretation, again, disaster, poverty, complaint, apparent, regarding, continued Cassette player music, speaker, tape, radio, telephone, instrument, musical, technology, electronic, phone, musician, communication, classic, battery, opposite, listen, topic, phrase, volume, sound, television, object, exchange, memory, item, record, motor, introduce, theme, communicate, cognitive, machine, context, rhythm, subject, comprehensive, contest, interpretation, camera, historian, love, player, equipment, regarding, definition, historical, hello, description, creative, chapter Parachute air, bag, tent, fabric, drop, above, day, swing, at, personal, helicopter, open, new, part, fairly, current, package, plane, under, and, second, fourth, another, then, first, far, favorite, from, opening, float, valley, modest, low, just, fun, third, patch, string, along, slightly, catch, flight, my, little, top, unusual, recent, launch, in, near Church church, religious, Catholic, religion, another, town, Christian, prayer, spiritual, priest, hospital, clinic, neighborhood, bank, museum, previous, again, newly, village, faith, where, various, last, rural, yesterday, holy, court, first, funeral, continued, recent, then, love, factory, today, sacred, cross, near, there, more, place, second, farm, school, from, something, past, porch, store, around French horn French, another, theme, cycle, instrument, rhythm, there, again, then, composition, first, musical, music, afternoon, compose, forth, third, bell, musician, circumstance, portion, borrow, comprehensive, continued, that, hour, around, second, sound, although, assessment, while, last, proposed, fourth, fun, along, telescope, slightly, this, just, yeah, previous, though, headline, hear, arrangement, definition, addition, brief Nudity naked, sex, hot, sexual, breast, modest, nut, and, dirty, skin, from, second, interested, physically, new, curious, also, third, just, enjoy, then, another, my, good, at, first, in, bad, current, day, kind, body, slightly, lovely, quite, recent, interesting, so, show, episode, near, full, primarily, unique, particularly, reveal, oh, ah, wide, today Kelly McKernan voice, between, put, emotional, blue, immediate, flesh, sweet, primarily, pale, newly, I, combination, currently, spending, fresh, consistent, provide, among, pair, international, teen, soul, income, him, kind, catch, feel, attractive, sister, pretty, fun, any, thin, and, good, inner, naturally, natural, recent, embrace, could, investigation, make, beneath, rough, post, attitude, lover, luck Ajin Demi Human angle, morning, prepare, human, eight, my, order, possible, hi, trace, democratic, unknown, should, political, remain, via, ill, identification, designer, new, story, heart, very, tension, nearly, just, perfect, medical, friendly, protein, hello, poor, killer, all, although, racial, thanks, religion, beginning, definition, juice, Arab, hot, senator, and, main, figure, prisoner, day, the vocabulary is more comprehensive but presents challenges due to the large number of nonsensical tokens (e.g., "...", "."</w>" ). Therefore, we need to filter out these nonsensical tokens to ensure the quality of the search space. The results from object-related concepts are shown in the table below. The results in Table 7 show that the erasing performance is slightly lower when using the CLIP token vocabulary as the search space, but the preservation performance is much better with a gap of 5.4% in PSR-1 and 4.2% in PSR-5. This indicates that the quality of the search space is a crucial factor for the performance of our method, and different tasks might require customized search spaces to achieve better performance.Choosing the model's parameters for fine-tuning. Firstly, it is a worth recall that the crossattention mechanism, i.e., σ((QK T ) √ d )V, where Q, K, and V are the query, key, and value matrices, respectively. In text-to-image diffusion models like SD, the key and value are derived from the textual embedding of the prompt, while the query comes from the previous denoising step. The cross-attention mechanism allows the model to focus on the relevant parts of the prompt to generate the image.Therefore, when unlearning a concept, most of the time, the erasure process is done by loosening the attention between the query and the key that corresponds to the concept to be erased, i.e., by fine-tuning the cross-attention modules. This approach works well for object-related concepts or artistic styles, where the target concept can be explicitly described with limited textual descriptions.However, as investigated in the ESD paper Section 4.1 (Gandikota et al., 2023) , concepts like 'nudity' or NSFW content can be described in various ways, many of which do not contain explicit keywords like 'nudity.' This makes it inefficient to rely solely on keywords to indicate the concept to be erased. It is worth noting that the standard SD model has 12 transformer blocks, each of which contains one cross-attention module but also several non-cross-attention modules such as self-attention and feed-forward modules, not to mention other components like residual blocks. Therefore, fine-tuning the non-cross-attention modules will have a more global effect on the model, making it more robust in erasing concepts that are not explicitly described in the prompt.To further support our claims, we conducted additional experiments on NSFW content erasure by fine-tuning the cross-attention modules. The results are presented in Table 8 . It can be seen that the erasure performance by fine-tuning the non-cross-attention modules is significantly better than fine-tuning the cross-attention modules only, observed by the lower NER scores across all thresholds. This phenomenon is also observed in both the ESD and our method. Our method outperforms ESD in all settings by a large margin, demonstrating the effectiveness of our method in erasing NSFW content.One of the main challenges in developing erasure methods is the lack of a proper metric to measure erasure performance. Specifically, performance is evaluated by how well the model forgets the target concept while retaining other concepts. This raises a critical question: how can we validate whether a concept is present in a generated image? Although this may seem like a simple task, it is quite challenging due to the vast number of concepts that generative models can produce. It is infeasible to have a classification model capable of detecting all possible concepts.While the FID score is a commonly used metric to assess the generative quality of models, it may not be sufficient for evaluating erasure performance. To the best of our knowledge, the CLIP alignment score is the most suitable existing metric for measuring concept inclusion. However, it is not without limitations. For example, CLIP's training set does not include NSFW content, making it less reliable for detecting such concepts. We believe that a more comprehensive evaluation metric is still lacking and that developing one would be a valuable direction for future research.To further understand how our method searches for adversarial concepts, we provide intermediate results of the search process in Figure 6 . The experiment is conducted on the Imagenette dataset with the same settings as in Section 5. Specifically, we simultaneously erase five concepts: "Garbage truck", "Cassette player", "Parachute", "Church", and "French horn".In Figure 6 , we show the images generated from the most sensitive concepts c a found by our method in the odd rows, as well as the corresponding to-be-erased concepts in the even rows. It is worth noting that all images are generated from the same initial noise input z T , resulting in a similar background while still containing the target concepts, as shown in the first column of the even rows.The Removal Effect Through Fine-Tuning Steps. As shown in the even rows, we observe that the model gradually removes the to-be-erased objects from the generated images as the fine-tuning steps increase. Interestingly, these to-be-erased concepts tend to collapse into the same concept, even though they started from different concepts. For example, the "Garbage truck" and "Cassette player" in the 2 nd and 4 th rows eventually transform into a background-like image in the last column. This can be explained by the fact that in the objective function 4, the erasing loss uses the same null concept c n for all to-be-erased concepts, which encourages the model to remove them simultaneously, eventually leading to the collapse of these concepts into the same form. This phenomenon can be an interesting direction for future research to investigate the relationship between different concepts in the erasing process, and the benefits of using different null concepts for different to-be-erased concepts.The Adversarial Concepts Adapt Through Fine-Tuning Steps. On the other hand, the images generated from the most sensitive concepts c a in the odd rows show how they adapt to the erasing process. Interestingly, while the adversarial concepts c a can vary in each fine-tuning step-for example, the adversarial concept for "Garbage truck" in the first row changes from "truck", to "title", to "morning", and converges to "great" in the last column-the generated images G(θ ′ t , z T , c a ) change smoothly through the increasing fine-tuning steps t. This can be explained by the continuous update of the model θ ′ t in each fine-tuning step, making G(θ ′ t , z T , "truck") and G(θ ′ t+1 , z T , "title") are smoothly connected. This smooth transition of the generated images from the adversarial concepts c a demonstrates an advantage of our method, which allows for finding visual adversarial concepts rather than sticking to specific keywords. In this section, we provide empirical examples to show that finding the most sensitive concept c a is not always straightforward when using heuristic methods, which further emphasizes the advantage of our method.Can we use the similarity in the textual embedding space to find the most sensitive concept? Large pretrained multimodal models like CLIP have been widely used for zero-shot learning because their textual embedding space is highly correlated with the visual space. Intuitively, one might think that the similarity between the target concept c e and other concepts in the textual embedding space can help identify the most sensitive concept c a . For example, the closer a concept c i is to the target concept c e in the textual embedding space, the more likely it is to be the most sensitive concept c a . However, we demonstrate that this heuristic method is not always effective.We conducted a similar analysis as in Section 3.2, including the similarity score between the target concept c e and other concepts in the textual embedding space to rank the concepts. Figure 7 shows the correlation between the drop in the CLIP scores between the base/original model and the sanitized model (i.e., after removing the target concept "nudity") and the similarity score between the target concept "nudity" and other concepts in the textual embedding space.It can be seen that the above intuition does not always hold, as the similarity score does not correlate with the drop in the CLIP scores. For example, except for the concept "naked", the null concept is the most similar to "nudity" in the textual embedding space, but it experiences the lowest drop in CLIP scores. On the other hand, two concepts, "a photo" and "president", are close in the textual embedding space but are affected differently during the erasing process. This demonstrates that similarity in the textual embedding space is not an appropriate metric for identifying the most sensitive concept in this context.In addition to the quantitative results presented in Section 5, we provide qualitative results in this section to further demonstrate the effectiveness of our method compared to the baselines. Due to our internal policy on publishing sensitive content, we are only able to show examples from two settings: erasing object-related concepts and erasing artistic concepts.Erasing Concepts Related to Physical Objects Figures 9, 10, and 11 show the results of erasing object-related concepts using ESD, UCE, and our method, respectively. Figure 8 shows the generated images from the original SD model. Each column represents different random seeds, and each row displays the generated images from either the to-be-erased objects or the to-be-preserved objects.From Figure 8 , we can see that the original SD model can generate all objects effectively. When erasing objects using ESD (Figure 9 ), the model maintains the quality of the preserved objects, but it also generates objects that should have been erased, such as the "Church" in the second row. This aligns with the quantitative results in Table 1 , where ESD achieves the lowest erasing performance.When using UCE (Figure 10 ), the model effectively erases the objects as shown in rows 1-5, but the quality of the preserved objects is significantly degraded, such as "tench" and "English springer" in the 8th and 9th rows. This is consistent with the quantitative results in Table 1 , where UCE achieves the highest erasing performance but the lowest preservation performance.In contrast, our method (Figure 11 ) effectively erases the objects while maintaining the quality of the preserved objects.Erasing Artistic Concepts Figures 12, 13, and 14 show the results of erasing artistic style concepts using our method compared to the baselines. Each column represents the erasure of a specific artist, except the first column, which represents the generated images from the original SD model. Each row displays the generated images from the same prompt but with different artists. The ideal erasure should result in changes in the diagonal pictures (marked by a red box) compared to the first column, while the off-diagonal pictures should remain the same. The results demonstrate that our method effectively erases the artistic style concepts while maintaining the quality of the remaining concepts. Justification: Our code is anonymously published at https://anonymous.4open. science/r/Adversarial-Erasing/.Guidelines:• The answer NA means that paper does not include experiments requiring code. • Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.https://github.com/fastai/imagenettehttps://lightning.ai/docs/torchmetrics/stable/multimodal/clip_score.htmlhttps://openai.com/index/dall-e-2-pre-training-mitigations/https://www.oxfordlearnersdictionaries.com/wordlist/american_english/oxford3000/ 


Decision: This paper studies methods to erase certain concepts from diffusion models, specifically focusing on NSFW and artistic concepts as a main use case. The challenge here is that if certain concepts are removed, then highly correlated ones could be impacted (e.g., removing 'nudity' may impact general generation of people). Compared to prior work, this paper focuses on an adversarial learning approach, looking at concepts that are most affected by parameter changes. The authors also investigate the trade-off between removing some concepts while actively trying to not adversely impact other concepts. This differentiates the present work from other baselines (e.g., Forget-Me-Not) because prior work focuses more on erasing concepts, rather than the trade-off between erasure and preservation.

This is a tough paper to evaluate. The reviewers all agree that this is a very important and timely problem to study, as diffusion models are becoming more wide-spread, while still not being very well understood in terms of undesirable concept generation. Reviewers have several complaints about the comparison to different methods (e.g., MACE), the inclusion various metrics (e.g., FID), and way the conclusions are drawn from the experimental results. For the last point, a core criticism is that the authors have not thoroughly discovered where the concepts originate from (e.g., different layers of the model vs. the latent embeddings). However, the authors have addressed many of these negative points in the appendix and in the rebuttal.

The reviewers that vote for acceptance are effectively championing the paper, where they have also had a very thorough back-and-forth with the authors during the rebuttal period. Namely, the main selling point is that the paper tries to address an important problem, and make a real world impact. The reviewers that vote for rejection raise valid points. However, I think that the importance and inherent complexity of the problem means that we cannot expect clear-cut evaluations, and hence, it is worth accepting a paper that will have impact by inspiring more nuanced follow-up work. The space of concept erasure in diffusion models is also not especially crowded at the moment, and therefore, the present work does present a lot of novel findings, research frameworks, and empirical insights compared to the related work.

Overall, I recommend acceptance. 

For the authors, please add experiments comparing to forget-me-not, adding experiments for SDXL (if possible) and include much more details in the appendix and main paper to address the comments from the reviewers. Also, as a way to address the negative reviews, please consider rephrasing some of the findings in the abstract/intro to be more clear about the findings of the paper. For example it is too broad to say that "This approach ensures stable erasure with minimal impact on the other concepts."

Reviews: review: paper_summary: paper_summary: This paper studies the memory-forgetting tradeoff for concept removal. The authors systematically summarize the tradeoff problem, and propose the idea of adversarial concepts to solve it. Specifically, this approach automatically detects the most sensitive concepts that will be affected by unlearning, and enforces the model to maintain the performance of sensitive concepts by adding the maintaining loss.
strength_weakness: strength_weakness: 1. Results are mainly on SD1.4. Additional results on other stable diffusion models should be included. For example, on larger diffusion models like SD XL, to further validate the effectiveness of the proposed method.
2. In the experiment section, comparisons with existing state-of-the-art methods, such as SPM [1], are lacking.
3. The ESR-k and PSR-k metrics used by the authors are reasonable and widely adopted by previous methods. However, additional metrics, such as FID and CLIP Score, should also be included to demonstrate the model's performance in the object unlearning scenario. Similarly, evaluating the FID metric on COCO-30K is also necessary.
4. When visualizing results in the appendix, the authors should show images before and after unlearning to provide a more intuitive sense of performance. Specifically, changes in unrelated concepts should be minimal. The current images only indicate that the concept has not been forgotten, rather than showing that the generated images under the prompt have not changed.
5. Efficiency is also an important evaluation metric in machine unlearning. The authors should adequately compare the efficiency of their method with previous methods.
6. When comparing methods, the authors should contrast their preservation methods with previous methods, such as the modules used in ConAbl [2] and SPM [1], to highlight performance differences.

[1] One-dimensional Adapter to Rule Them All: Concepts, Diffusion Models, and Erasing Applications
[2] Ablating Concepts in Text-to-Image Diffusion Models
questions: questions: How to select the parameter $\lambda$? It seems that different concepts may need different coefficients.
limitations: limitations: Yes
paper_summary: paper_summary: This paper focuses on the problem that existing concept erasing methods struggle to address the trade-off between the generation capability of erased concepts and remaining concepts. To address this problem, this paper proposes a method that erases the target concept while minimizing the impact of other concepts. Specifically, this paper finds that related concepts are sensitive during the erasing process of the target concept. For example, when erasing 'nudity', some related concepts, such as 'woman' and 'people' will be significantly impacted. Motivated by this observation, this paper first utilizes an optimization method to automatically find the adversarial concepts related to the target concept. Following this, this paper iteratively applies the preservation constraint on these adversarial concepts during the erasing process.
strength_weakness: strength_weakness: - The motivation of this paper needs further discussed. My core issue is: Do all related concepts need to be preserved? For example, if we want to erase 'airplane', do 'aircraft' and 'warplane' need to be preserved? Motivated by this issue, I argue that there should be a boundary between the preserved and erasing concepts, while this paper ignores this boundary. More extremely, some works [1,2,3] argue that we should erase concepts related to the target concept.
- Lack of comparison with the latest methods, such as MACE [4].
- In the experiment of erasing object-related concepts, it is suggested to add an experiment that demonstrates the generalization of the model. For example, following MACE [4], this paper can evaluate the erasing capability on the synonyms of the erasing concept.
- In the experiment of erasing NSFW content, this paper lacks an evaluation of the generation capability on the common concepts. Following [2,3], this paper can evaluate the FID of the model on COCO dataset.
questions: questions: Please check weaknesses.
limitations: limitations: NA
paper_summary: paper_summary: The present paper addresses the challenge of erasing content from text-to-image diffusion models with a focus on reducing the degenerative impact on other concepts. To this end, the authors propose a novel approach that focuses on identifying and preserving adversarial concepts—those which are most affected by changes in model parameters during the erasure. To provide evidence, the authors conduct empirical investigations and various experiments using the open-source Stable Diffusion model, demonstrating their method’s potential to reliably erase target concepts while offering minimal impact on non-target concepts.
strength_weakness: strength_weakness: - While the paper showcases the benefits of the proposed method, the observations and conclusions drawn from the empirical experiments do not fully align with what is described by the authors, particularly regarding the minimal impact on other concepts. For example, in lines 231-232, the authors state that the proposed method achieves much higher ESR scores than the two baselines ESD and CA; however, this claim is not entirely accurate, especially in the case of CA. Similarly, the improvements over the baselines shown in the third experiment are not as significant as described, particularly when considering the standard deviations presented in Table 3. The paper would benefit from a more detailed discussion and analysis of these results.
questions: questions: - As far as I understand, the set of concepts used to search for adversarial concepts is derived from the list of words in the initial prompt (lines 76-79). However, it appears to be a common set used across multiple examples. Can you provide more details and clarify how this set of concepts is selected? Have you experimented with different sets of initial concepts?

- Further, you mentioned in lines 252-255 that, in the case of mitigating unethical content, it is necessary to fine-tune the non-cross-attention modules. Can you elaborate on why this is the case?

Minor comments: 
- In line 238, CA seems to be the best baseline, not ESD.
limitations: limitations: The authors addressed limitations in the appendix as stated in the checklist.
paper_summary: paper_summary: This paper investigates erasing undesirable concepts from stable diffusion. The paper builds up on a common finding on related works, that is removing even one concept can significantly rescue model’s ability to generate other concepts. Existing methods typically select a neutral concept, such as "a photo" or an empty string, as an anchor to preserve while erasing the target concept, expecting that maintaining the neutral concept should help retain other concepts as well (UCE, TIME). However, even regularization attempts using these neutral concept still affects the desirable concepts. This paper first find most sensitive concept for erasure, and then using a min-max (adversarial) adds another term to the loss function to remove only undesirable concepts.
strength_weakness: strength_weakness: - wrong citation for UCE in line 23
- Lines 29-30 are written as a strong conjecture without support. "no specific part of the model’s weights is solely responsible for a single concept". I have seen counter examples in the literature. See [1] for example
- While proposed method is showing improvement over related works, I doubt the practical usage and hence raise some questions.




[1] Basu, Samyadeep, et al. "On Mechanistic Knowledge Localization in Text-to-Image Generative Models." Forty-first International Conference on Machine Learning. 2024.
questions: questions: - Which CLIP model is used?
- Why using a CLIP alignment score is a reliable measure for concept inclusion? For example a CLIP model that is trained on non-NSFW or non-GORE data cannot detect nudity/violence. What would your proposed method rely as a capability measure then?
- Line 152: the results of erasing the nudity concept, provided in the Appendix... I could not see this results. Best is also to have reference to specific plot/section in the appendix whenever you refer to appendix. 
- Line 255: finetuning the non-cross-attention modules. I belive that including more details here is crucial. Why do you finetune only non-cross attention modules?
- Line 275: Did you see that FID is sufficient as a quality measure of generated samples when removing concepts? For example, removing nudity might distort anatomy and is not reflected in FID?
- Figure 4: We know that for nudity there is a huge difference between Feet and female breast for example. How would your proposed method only remove the later while keeping the non-sensitive parts untouched?
- What is the level of granularity in the proposed method? e.g. can we use this method to remove Mercedes logo from cars?
- How does your proposed method differ to "Forget-Me-Not" paper [1]? Any specific reason this is not covered in comparisons?
- I am curious to see what you think of task vectors [2] as a potential direction to remove undesirable concepts?

> code
- Code: train_adversarial_gumbel.py - lines 461-490: I could not see the implementation of equation (4) in these lines. Should not it be "loss += criteria(z_n_wo_prompt_pred.to(devices[0]), z_0_org_pred.to(devices[0]))" for L1 and "loss = -negative_guidance * criteria(z_r_wo_prompt_pred.to(devices[0]), z_r_org_pred.to(devices[0]))" for L2?
- When using L2 distance for similarity between vocab and the erasure wor, why do you use K-means? Why not using the top-n from the similarity result? did you look into result differences between these two?
- In the case of Stable Diffusion 3 (and SDXL), we have to have pooled and non-pooled captions. How would you calculate emb_r for the pooled embedding needed to  condition on time?

[1] Zhang, Gong, et al. "Forget-me-not: Learning to forget in text-to-image diffusion models." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024.
[2] Ilharco, Gabriel, et al. "Editing models with task arithmetic." arXiv preprint arXiv:2212.04089 (2022).
limitations: limitations: already addressed as questions for further discussions

Comments: title: Thank you the reviewer
Score update
Thank you the reviewer
response to authors
Further response
Further responses (2/n)
Further responses (1/n)
answer to Authors rebuttal
Looking forward to your responses!
Looking forward to your responses!
Looking forward to your responses!
Looking forward to your responses!
Further responses
Further response
comment: We greatly appreciate the reviewer for raising the score. We will incorporate the suggested discussions into the revised version. Once again, thank you for your time and effort in reviewing our work.
Thank you again for the effort. The provided clarifications will improve the soundness of the paper and its claims. I updated my score accordingly.
We greatly appreciate the reviewer's supportive feedback and insightful comments, which have not only significantly improved our paper but also pointed out aspects we had not considered. We will incorporate the suggested discussions into the revised version. Once again, thank you for your time and effort in reviewing our work.
I thank the authors for working hard, adding additional experiments and addressing all my concerns. I would like to increase my score by 2, now to 7.
We thank the reviewer for actively engaging in the discussion and providing valuable feedback. 

Regarding the discussion on "fine-tuning the non-cross-attention modules": In addition to the explanation provided in the previous response, we would like to provide additional experiments with the ESD method with different fine-tuning strategies as below. 
More specifically, we compare the erasure performance of the ESD method by fine-tuning the cross-attention modules only (ESD-x) and fine-tuning non-cross-attention modules only (ESD-u).

|          | NER-0.3↓ | NER-0.5↓ | NER-0.7↓ | NER-0.8↓ |
|----------|----------|----------|----------|----------|
| SD       | 16.69    | 10.91    | 5.46     | 2.02     |
| ESD-x    | 10.25    | 5.83     | 2.17     | 0.68     |
| ESD-u    | 5.32     | 2.36     | 0.74     | 0.23     |
| Ours-u   | 3.64     | 1.70     | 0.40     | 0.06     |

It can be seen that the erasure performance by fine-tuning the non-cross-attention modules is significantly better than fine-tuning the cross-attention modules only, 
observed by the lower NER scores across all thresholds. 

The detailed results at threshold 0.5 are shown in the table below, with the number of exposed parts and the number of images with any exposed parts.

|                        | SD  | ESD-x | ESD-u |
|------------------------|-----|-------|-------|
| Feet                   | 92  | 61    | 24    |
| Belly                  | 212 | 81    | 21    |
| Armpits                | 261 | 123   | 63    |
| Buttocks               | 53  | 26    | 3     |
| Male Breast            | 75  | 27    | 14    |
| Male Genitalia         | 23  | 13    | 9     |
| Female Genitalia       | 28  | 7     | 1     |
| Female Breast          | 331 | 124   | 38    |
| Total #exposed part    | 1075| 462   | 173   |
| Total #img-with-any-expose | 513 | 274 | 111   |
| NER                    | 10.91| 5.83 | 2.36  |
**Q: Granularity/only remove the sensitive parts while keeping the non-sensitive parts**

We thank the reviewer for the insightful questions. We will add further discussions on the practical usage of the proposed method. As highlighted in the main paper, our primary goal is to focus on the preservation aspect of the erasure process. To the best of our knowledge, our method is the first to examine the impact of erasing a target concept on other concepts and to propose an adaptive strategy for preserving the most affected concepts to maintain the model's performance on other concepts.

***Regarding the less intuitive responses***, we would like to provide the similarity scores between different concepts and body parts in the nudity erasure setting as below.

|                        | Nudity | A photo | Person | Body  |
|------------------------|--------|---------|--------|-------|
| Feet                   | 0.612  | 0.547   | 0.566  | 0.643 |
| Belly                  | 0.601  | 0.514   | 0.517  | 0.748 |
| Armpits                | 0.614  | 0.477   | 0.475  | 0.643 |
| Buttocks               | 0.649  | 0.501   | 0.494  | 0.639 |
| Male Breast            | 0.616  | 0.499   | 0.472  | 0.504 |
| Male Genitalia         | 0.618  | 0.511   | 0.537  | 0.517 |
| Female Genitalia       | 0.662  | 0.536   | 0.558  | 0.555 |
| Female Breast          | 0.656  | 0.517   | 0.491  | 0.574 |

It can be seen that the "nudity" concept is highly correlated with the "Female Breast" concept, suggesting that when removing the "nudity" concept, the "Female Breast" concept is more likely to be affected than other body parts. On the other hand, the "Person" or "Body" concept is more strongly correlated with the "Feet" concept than with the "Female Breast" concept, indicating that preserving the "Person" concept might help maintain the model's performance on "Feet" rather than on "Female Breast."

Furthermore, the gap between the "Feet" and "Female Breast" concepts with respect to "Person" or "Body" is larger than the gap with more generic concepts like "A photo." This suggests that preserving generic concepts might not have the same impact as preserving the most affected concepts.

Our method naturally selects the most affected concepts to be preserved, which often includes concepts highly correlated with non-sensitive body parts. This explains the observed phenomenon in the experiment.

***Regarding potential directions to improve the granularity of the method***, we would like to provide two potential directions:

- Enhancing the expressiveness of the textual description: By providing more detailed textual descriptions, the model can distinguish between closely related concepts, such as separating the Mercedes logo from the car itself. 
For example, in Equation 4 and Equation 5, instead of using the textual embedding $c_e = \tau(\text{"Mercedes logo"})$, we could use the Textual Inversion method to learn a visual embedding $c_e = TI(X_{c_e})$ from the representative images of the Mercedes logo concept $X_{c_e}$.  This approach provides a richer expressiveness to specify the target concept to be erased.

- Searching for multiple affected concepts: In the current approach, we search for the most affected concept to be preserved for each target concept. This approach is simple and fast but of course, has limited representative capability. 
Intuitively, each target concept connects to many other concepts, and choosing several affected concepts can provide a more comprehensive perspective on the impact of erasing the target concept. 
It can be done by applying SVGD (Stein Variational Gradient Descent) to search for multiple affected concepts, which encourages the method to explore a diverse set of concepts with high relevance to the target concept.

**Q: "Forget-Me-Not" paper**

We will include a comparison with the Forget-Me-Not method in the revised version. For this comparison, we followed the instructions provided in their repository to set up experiments for erasing single concepts from the Imagenette dataset. Unfortunately, we were unable to effectively erase the target concepts using this method.

Specifically, we followed these steps:

- Provided representative images of the target concepts (8 images per concept) to train the inversion models.
- Executed the inversion process using the ti_config.yaml configuration file.
- Conducted the erasure process with the attn.yaml configuration file.
- Generated and stored images with the erased concepts in the evaluation_folder/exps_attn directory.

We have uploaded the code for this experiment to the anonymous repository. You can find the config files, run file, and generated images in the Forget-Me-Not/evaluation_folder/exps_attn folder. The generated images still contain the target concepts, except for the "parachute" concept, indicating that the Forget-Me-Not method was not effective for erasing the target concepts in our setting. Please refer to the code for additional details.
We thank the reviewer for actively engaging in the discussion and providing valuable feedback. In the following, we would like to address the reviewer's further comments:

**Q: I believe that limitations of using CLIP score should be clearly mentioned in your draft and you need to focus more on non-NSFW removal because of limitations mentioned before.** 

We appreciate the reviewer's feedback. We will discuss the limitations of using the CLIP alignment score in the revised version.

**Q: Results of erasing nudity concept** 

We appreciate the reviewer's recommendation and deeply apologize for forgetting to provide the details of the figure in the main paper and the appendix. 
We provided the results of erasing the "nudity" concept while preserving the "person" concept in the attached document in the global rebuttal. 
More specifically, we compare the impact of erasing the same "nudity" to other concepts with different preserving strategies, including preserving a fixed concept such as " ", "person", and the most affected concepts found by our method.
We will add a reference to the specific figure in the revised version.

**Q: Do you have any results/references to ESD that supports/compares cross-attention finetuning vs. all attention finetuning?**

In addition to the explanation provided in the previous response, we would like to provide additional experiments with the ESD method with different fine-tuning strategies as below. 
More specifically, we compare the erasure performance of the ESD method by fine-tuning the cross-attention modules only (ESD-x) and fine-tuning non-cross-attention modules only (ESD-u).

|          | NER-0.3↓ | NER-0.5↓ | NER-0.7↓ | NER-0.8↓ |
|----------|----------|----------|----------|----------|
| SD       | 16.69    | 10.91    | 5.46     | 2.02     |
| ESD-x    | 10.25    | 5.83     | 2.17     | 0.68     |
| ESD-u    | 5.32     | 2.36     | 0.74     | 0.23     |
| Ours-u   | 3.64     | 1.70     | 0.40     | 0.06     |

It can be seen that the erasure performance by fine-tuning the non-cross-attention modules is significantly better than fine-tuning the cross-attention modules only, 
observed by the lower NER scores across all thresholds. 

The detailed results at threshold 0.5 are shown in the table below, with the number of exposed parts and the number of images with any exposed parts.

|                        | SD  | ESD-x | ESD-u |
|------------------------|-----|-------|-------|
| Feet                   | 92  | 61    | 24    |
| Belly                  | 212 | 81    | 21    |
| Armpits                | 261 | 123   | 63    |
| Buttocks               | 53  | 26    | 3     |
| Male Breast            | 75  | 27    | 14    |
| Male Genitalia         | 23  | 13    | 9     |
| Female Genitalia       | 28  | 7     | 1     |
| Female Breast          | 331 | 124   | 38    |
| Total #exposed part    | 1075| 462   | 173   |
| Total #img-with-any-expose | 513 | 274 | 111   |
| NER                    | 10.91| 5.83 | 2.36  |

**Q: I believe that running FID is a good automatic evaluation but not sufficient. You should always look at generated samples and include them. (examples in the appendix are good enough)** 

We thank the reviewer for the suggestion. Because of the page limit, we could not include the generated samples in the main paper. 
We will try to include them in the revised version or provide a clear reference to the appendix.
Thank you for the rebuttal and for including the additional experiments, which have clarified some aspects of the search space design. I also appreciate the additional experiments shown in the global rebuttal.

Regarding the claim to “fine-tune the non-cross-attention modules,” I agree with Reviewer fKJG that presenting results to support this claim would significantly strengthen the argument.
Thank you for taking the time to address my concerns. Unfortunately some of my questions are still not addressed and I really hope that we can discuss over those to conclude this rebuttal. Please see my responses below
    
    Q: reliability of CLIP alignment
I believe that limitations of using CLIP score should be clearly mentioned in your draft and you need to focus more on non-NSFW removal because of limitation mentioned before. 

    Q: Results of erasing nudity concept
I could not find these results. When adding any new figures/plots provide details how to find them and make the life of reader easier. This is also my strong recommendation when writing your draft. You need to add details which figure in Appendix you are referring to. 

    Q: Why do you finetune only non-cross attention modules to erase NSFW concepts?
Do you have any results/references to ESD that supports/compares cross-attention finetuning vs. all attention finetuning? 


    Q: Discussion on FID metric?
I believe that running FID is a good automatic evaluation but not sufficient. You should always look at generated samples and include them. (examples in the appendix are good enough)

    Q: Granularity/only remove the sensitive parts while keeping the non-sensitive parts
My main concern, that is not reflected in limitations is the practical usage of the proposed method. When asking these question, I was hoping to get some non-intuitive responses, such as evidences to support the strength of the proposed method or at least discussions on the future directions. 

    Q: "Forget-Me-Not" paper
I think that the comparison with this work should be included in the main manuscript. I was surprised not to see this in the comparisons. Please provide any results of you have tried single concept with this method. 

    Q: Coding question: Implementations of Equation 4 and Equation 5
I spent sometime to map your equations in the paper with the provided anonymous code when writing the original review, and hence asked specific details questions about any potential bug in your implementation. Please provide more details that might remove my/readers confusions. 

    Q: SDXL/SD3 implementation
I still do not understand how to get the pooled embedding. in both of these methods we need pooled and non-pooled features. I can see that non-pooled can be optimized using gumbel-softmax but your response still does not cover the pooled caption.
As the rebuttal period is coming to an end, we hope to have clarified the novelty of our contribution and addressed the concerns of the reviewer. We truly appreciate the reviewer's time on our paper and we are looking forward to your responses and/or any other potential questions. Your feedback would be very helpful for us to identify any ambiguities in the paper for further improvement.
As the rebuttal period is coming to an end, we hope to have clarified the novelty of our contribution and addressed the concerns of the reviewer. We truly appreciate the reviewer's time on our paper and we are looking forward to your responses and/or any other potential questions. Your feedback would be very helpful for us to identify any ambiguities in the paper for further improvement.
As the rebuttal period is coming to an end, we hope to have clarified the novelty of our contribution and addressed the concerns of the reviewer. We truly appreciate the reviewer's time on our paper and we are looking forward to your responses and/or any other potential questions. Your feedback would be very helpful for us to identify any ambiguities in the paper for further improvement.
As the rebuttal period is coming to an end, we hope to have clarified the novelty of our contribution and addressed the concerns of the reviewer. We truly appreciate the reviewer's time on our paper and we are looking forward to your responses and/or any other potential questions. Your feedback would be very helpful for us to identify any ambiguities in the paper for further improvement.
**Q: Which CLIP model is used?**

We used the OpenAI CLIP model `openai/clip-vit-large-patch14' to compute the alignment score. We will add this information to the revised version.

**Q: How does your proposed method differ to the "Forget-Me-Not" paper? Any specific reason this is not covered in comparisons?**

Our method significantly differs from the Forget-Me-Not (FMN) method. From our point of view, FMN falls into the category of approaches like TIME, UCE, and MACE, 
which focuses on confusing the alignment between the prompt and the visual features in the cross-attention mechanism. 
Specifically, FMN introduces an attention resteering method that attempts to alter the attention maps related to the target concept (i.e., by minimizing the L2 norm of the attention maps).
Our method, on the other hand, stands out by focusing on identifying which concepts are most affected by the erasure of a target concept and then preserving these concepts to maintain the model's capability on other concepts.
We will cite and discuss the FMN in the revised version.

Regarding additional experiments with the FMN method, we attempted to erase the same set of concepts from the Imagenette dataset and evaluated the erasing and preservation performance of the FMN method within our setting.
However, despite our best efforts given the time constraints, FMN did not effectively erase the target concepts. 
Notably, their open-source code provides hyper-parameter settings for single-concept erasure but not for multiple concepts. 
We also noticed an open issue on their GitHub repository questioning this same problem.

This issue can easily be verified by running their code with a modified configuration file, `attn.yaml`, 
to erase multiple concepts, given some representative images of the target concepts.

**Q: Coding question: Implementations of Equation 4 and Equation 5** 

Equation 4 describes our naive approach, which utilizes Projected Gradient Descent (PGD) to search for the adversarial concepts in the continuous space. We have uploaded the code for this approach to the anonymous repository. Please refer to the code for more details.

Regarding the implementation of Equation 5, our method involves bilevel optimization. In this process, the inner maximization step maximizes the L2 loss (i.e., minimizes -L2 loss) to select the most affected concepts to be preserved. The outer minimization step minimizes the combined L1 + L2 loss to erase the target concepts while preserving the most affected concepts.

For the L1 loss, we inherited this implementation from the ESD paper and did not attempt to modify it, including the aspect of negative guidance.

**Q: Coding question: Why using K-means?**

In the implementation, we investigate the use of K-means to control the tradeoff between the computational cost and the size of the vocabulary when searching for adversarial concepts. More specifically, we first compute the similarity between the target concept and the entire vocabulary, then select the top-K most similar concepts. We then use K-means to choose the K most representative concepts from these top-K most similar concepts. This approach allows us to cover a wide range of concepts while keeping the computational cost low.

**Q: Coding question: How to calculate the text embedding for adversarial concepts in Stable Diffusion version 3**

To the best of our understanding, as described in the `encode_prompt` function in the Stable Diffusion v3 pipeline (lines 310-311), 
as similar to the same function in the SDXL pipeline (line 397), we still can obtain the standard prompt embedding as the output of a text encoder which is independent of the time step. Therefore, we can still use our current approach to calculate the `emb_r` for the adversarial concepts.
**Q: Better visualization**

In Figures 9-11 in the Appendix, we already provided a comparison between the output generated by the same prompt using the original model and the sanitized models after erasing each specific artistic style.

In each sub-figure, the first column shows the images generated by the original model, while the second to sixth columns display the images generated by the sanitized models. Each row corresponds to a prompt of one of these five artists.

The ideal erasure should result in changes in the diagonal pictures (marked by a red box) compared to the first column, while the off-diagonal pictures should remain the same.
We believe that these visualizations are clear and informative, providing a direct comparison between the original and sanitized models.