Research map / Image generation / Text-to-image diffusion
Six-CD: Benchmarking Concept Removals for Text-to-image Diffusion Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Benchmarks ten concept-removal methods for Stable Diffusion across six unwanted-concept categories using a new Six-CD dataset, high-effectiveness prompt subsets, and a new in-prompt CLIP score for retainability.
Problem
Existing concept removal evaluations for text-to-image diffusion models are inconsistent, use many ineffective prompts (especially for nudity and harm), and ignore whether benign parts of prompts with unwanted concepts are still generated.
Approach
Introduce Six-CD, a dataset covering six unwanted-concept categories split into general and specific concepts, with high-effectiveness subsets (harm-EF, nudity-EF), plus an in-prompt CLIP score computed on a Dual-Version Dataset to measure retention of benign prompt content after removal.
Key results
- Pearson correlation between removal ability on all nudity prompts and high-effectiveness nudity-EF prompts is 0.984 (harm vs harm-EF 0.977), supporting the use of high-effectiveness subsets.
- In-prompt CLIP scores are lower than out-prompt CLIP scores across all methods and categories, indicating benign parts of malicious prompts are harder to retain.
- Inference-time methods SLD and NEG fail to remove multiple concepts when the concept number exceeds 50, while closed-form linear-component methods perform best on multiple concepts.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Evaluate concept-removal methods on high-effectiveness prompts instead of the full Harm and Nudity subsets | concept-removal methods · Harm and Nudity | removal performance correlation: 0.977 (Harm); 0.984 (Nudity) | No clear effect |
| Remove multiple concepts using inference-time NEG or SLD rather than a fine-tuning method | concept-removal methods · multiple celebrities and copyrighted characters | detection rate | Hurt |
| Use an inference-time method that processes each concept separately as the number of concepts increases | SEGA · multiple concepts | inference time | Hurt |
| Modify linear components using closed-form solutions for multiple-concept removal | concept-removal methods · multiple celebrities and copyrighted characters | detection rate | Helped |
| Remove unwanted concepts from prompts while preserving their benign content | concept-removal methods · Dual-Version Dataset | in-prompt CLIP score | Hurt |
| Add auxiliary semantic information through Grounded-SAM segmentation | MACE · benign prompts and benign content within prompts | CLIP score | Hurt |
| Remove art styles without segmentation | MACE · art style | in-prompt and out-prompt CLIP scores | Helped |
Surprising findings
- General concepts (harm, nudity) are harder to remove than specific concepts, and no single method removes both harm and nudity well simultaneously.
- MACE, which uses Grounded-SAM segmentation, shows the largest drop in benign-concept generation quality on both in-prompt and out-prompt CLIP scores.
Limitations
- Art style removal is measured with normalized CLIP score rather than a classifier-based detection rate.
- Ineffective prompts in general-concept data make evaluation inefficient; the benchmark depends on detector accuracy (Q16, NudeNet) for labeling.
Experimental setup
Datasets: I2P MMA SD-uncensored Unsafe Diffusion CPDM ImageNet LAION FiveThirtyEight Comic Characters Dataset
Benchmarks: Six-CD Dual-Version Dataset
Metrics: detection rate in-prompt CLIP score out-prompt CLIP score FID removal percentage
Baselines: negative prompt ESD SPM SDD FMN UCE MACE EMCID SLD SEGA
Builds on: Stable Diffusion CLIP score ESD UCE MACE
Closest papers by meaning
- Comprehensive Assessment and Analysis for NSFW Content Erasure in Text-to-Image Diffusion models (NeurIPS 2025 · similarity 0.90)
- Growth Inhibitors for Suppressing Inappropriate Image Concepts in Diffusion Models (ICLR 2025 · similarity 0.90)
- Detect-and-Guide: Self-regulation of Diffusion Models for Safe Text-to-Image Generation via Guideline Token Optimization (CVPR 2025 · similarity 0.90)
- T2ISafety: Benchmark for Assessing Fairness, Toxicity, and Privacy in Image Generation (CVPR 2025 · similarity 0.89)
- MACE: Mass Concept Erasure in Diffusion Models (CVPR 2024 · similarity 0.89)
- Continuous Concepts Removal in Text-to-image Diffusion Models (NeurIPS 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.