Research map / Image generation / Text-to-image diffusion
When Are Concepts Erased From Diffusion Models?
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes conceptual models (guidance-based avoidance vs destruction-based removal) for diffusion concept erasure and a multi-probe evaluation suite (optimization, in-context, noise-based, classifier-guided, concept tracing) showing most erasure methods leave residual concept knowledge.
Problem
It is unclear whether concept erasure methods for text-to-image diffusion models truly remove the target concept or merely avoid generating it under standard prompts and adversarial text inputs.
Approach
Two conceptual erasure mechanisms (guidance-based avoidance and destruction-based removal) and a suite of independent probes beyond adversarial text inputs (visual context inpainting/diffusion completion, inference-time noise injection, latent classifier guidance, dynamic concept tracing) to test for residual knowledge.
Key results
- Under the proposed noise-based probe, UCE reaches 21.9% top-1 accuracy versus 18.31% for DDIM1, and ESD-x reaches 30.70% versus 20.62%.
- STEREO shows only 0.0% erased-concept accuracy and 3.7% under UnlearnDiffAtk, yet 1.1% under noise-based probing is low, while its classifier-guided probe recovers concepts at 5.8% accuracy (standard guidance) and 20.3% (classifier-guided noise probe).
- Diffusion completion at t=5 recovers concepts for RECE (36.5% accuracy) and UCE (42.7%), while Gradient Ascent drops to 1.1%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply Textual Inversion rather than the standard erased-concept prompt | UCE · Textual Inversion | Class Acc. (%): 4.4 -> 71.2 | Hurt |
| Apply inpainting context rather than the standard erased-concept prompt | TaskVec · Inpainting | CLIP: 23.1 -> 25.9 | Hurt |
| Provide an intermediate image from the unerased model at t=5 | TaskVec · Diffusion Completion t=5 | Class Acc. (%): 2.2 -> 2.4 | Hurt |
| Provide an intermediate image from the unerased model at t=10 | STEREO · Diffusion Completion t=10 | Class Acc. (%): 0.0 -> 21.2 | Hurt |
| Increase sampling noise during diffusion | UCE · Noise-Based Probing | Class Acc. (%) | Hurt |
| Add latent classifier guidance | STEREO · Standard Classifier Guidance | Class Acc. (%): 0.0 -> 5.8 | Hurt |
| Combine latent classifier guidance with noise-based probing | UCE · Classifier-Guided Noise-Based Probing | Class Acc. (%): 45.6 -> 75.6 | Hurt |
| Increase inference-time sampling noise from DDIM1 to the Noised-Based strategy | ESD-u · Noise-Based probe: esdu | CLIP Score: 25.80 -> 27.99 | Helped |
| Increase inference-time sampling noise from DDIM1 to the Noised-Based strategy | ESD-x · Noise-Based probe: esdx | Top-1 Accuracy (%): 20.62 -> 30.70 | Helped |
| Increase inference-time sampling noise from DDIM1 to the Noised-Based strategy | UCE · Noise-Based probe: uce | Top-1 Accuracy (%): 18.31 -> 21.90 | Helped |
Surprising findings
- Methods robust to optimization-based text attacks (Task Vector, RECE, STEREO) still resurface erased concepts under inpainting or diffusion completion probes.
- A simple training-free noise-injection probe recovers erased concepts that adversarial textual inversion and UnlearnDiffAtk fail to recover, e.g., for GA and STEREO.
Limitations
- Only 13 concepts (10 objects, 3 art styles) are studied; verbs, relations, and abstract concepts are not covered.
- Categorizing methods as guidance-based or destruction-based is tentative and not rigorously verified.
- Optimization-based probes may induce concepts the model never learned rather than reveal residual knowledge.
Experimental setup
Datasets: ImageNet-1k Imagenette
Benchmarks: CLIP score on erased concepts ImageNet classification accuracy UnlearnDiffAtk Textual Inversion probe inpainting diffusion completion
Metrics: CLIP score Top-1 classification accuracy
Baselines: UCE ESD-x ESD-u Gradient Ascent Task Vector STEREO RECE
Builds on: Textual Inversion UnlearnDiffAtk DDIM Unified Concept Editing Erased Stable Diffusion
Closest papers by meaning
- Fantastic Targets for Concept Erasure in Diffusion Models and Where To Find Them (ICLR 2025 · similarity 0.93)
- Erasing Undesirable Concepts in Diffusion Models with Adversarial Preservation (NeurIPS 2024 · similarity 0.93)
- All but One: Surgical Concept Erasing with Model Preservation in Text-to-Image Diffusion Models (AAAI 2024 · similarity 0.90)
- MACE: Mass Concept Erasure in Diffusion Models (CVPR 2024 · similarity 0.90)
- You Can’t Have It Both Ways: Concept Entanglement Limits Diffusion Model Unlearning (NeurIPS 2026 · similarity 0.90)
- EraseAnything: Enabling Concept Erasure in Rectified Flow Transformers (ICML 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.