Research map / Image generation / Text-to-image diffusion
Circumventing Concept Erasure Methods For Text-To-Image Generative Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that seven post hoc concept erasure methods for Stable Diffusion can be circumvented by learning special word embeddings (Concept Inversion) that recover erased concepts without modifying model weights.
Problem
Post hoc concept erasure methods claim to permanently remove sensitive concepts (NSFW content, artistic styles, objects, celebrity likenesses) from text-to-image diffusion models, but it is unclear whether the concepts are truly excised from weights.
Approach
Concept Inversion (CI) applies Textual Inversion against each sanitized model (with weights frozen) to learn a new placeholder word embedding that regenerates the erased concept; the authors adapt the objective per method (e.g., NP and SLD variants that match guidance terms) and show learned embeddings transfer to the original SD 1.4.
Key results
- Across seven erasure methods, Concept Inversion raised average ResNet-50 object classification accuracy from 9.89% to 57.94% on erased objects.
- For artistic styles, the human study Likert score rose from 1.31 on erased models to 3.7 with Concept Inversion.
- NSFW exposed body part detections rose from 26.2 on erased models to 170.93 with Concept Inversion, while SLD-Max was the most robust variant.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply Concept Inversion to the erased models | Seven concept erasure methods on artistic styles · Art styles | human Likert rating: 1.31 to 3.7 | Helped |
| Apply Concept Inversion to the erased models | Seven concept erasure methods · Imagenette object concepts | classifier accuracy: 9.89 to 57.94 | Helped |
| Apply Concept Inversion to the erased models | Seven concept erasure methods · Brad Pitt and Angelina Jolie | GIPHY detector accuracy: 8.15 to 67.13 | Helped |
| Apply Concept Inversion to the erased models | Seven concept erasure methods · I2P NSFW prompts | detected exposed body parts: 26.2 to 170.93 | Helped |
| Use SLD-Max instead of weaker SLD variants (ablation) | Safe Latent Diffusion · Concept recovery across tested concepts | Concept Inversion recovery | Hurt |
| Use SLD-Max (ablation) | Safe Latent Diffusion · Generated images | visual semantics preservation | Hurt |
Surprising findings
- Learned embeddings found on erased models can be transferred to the original unmodified SD 1.4 to generate the erased concept.
- Textual Inversion alone struggles to recover concepts poorly represented in training data, suggesting it does not hallucinate novel concepts.
Limitations
- Concept Inversion for SLD requires substantial GPU memory and uses an approximation of guidance terms.
- Some erased models (e.g., for certain styles) produce poor-quality images where CI fails to recover the concept.
- Adversary is assumed to have model weight access and example images of the target concept.
Experimental setup
Datasets: Imagenette I2P Google Images samples of artists and celebrities MNIST LAION-5B
Benchmarks: Imagenette I2P GIPHY celebrity detector evaluation
Metrics: top-1 classification accuracy NudeNet exposed body part count celebrity detector accuracy human Likert style score CLIP reconstruction and editability scores
Baselines: Erased Stable Diffusion (ESD) Unified Concept Editing (UCE) Selective Amnesia (SA) Forget-Me-Not (FMN) Ablating Concepts (AC) Negative Prompt (NP) Safe Latent Diffusion (SLD)
Builds on: Textual Inversion classifier-free guidance Latent Diffusion Models Safe Latent Diffusion
Closest papers by meaning
- MACE: Mass Concept Erasure in Diffusion Models (CVPR 2024 · similarity 0.91)
- Minimalist Concept Erasure in Generative Models (ICML 2025 · similarity 0.91)
- ConceptPrune: Concept Editing in Diffusion Models via Skilled Neuron Pruning (ICLR 2025 · similarity 0.90)
- All but One: Surgical Concept Erasing with Model Preservation in Text-to-Image Diffusion Models (AAAI 2024 · similarity 0.90)
- Semantic Surgery: Zero-Shot Concept Erasure in Diffusion Models (NeurIPS 2025 · similarity 0.90)
- Localized Concept Erasure for Text-to-Image Diffusion Models Using Training-Free Gated Low-Rank Adaptation (CVPR 2025 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.