The paper introduces AVCE, a method for verifiable concept erasure in diffusion models that audits latent representations to identify vulnerable directions and then edits cross‑attention and self‑attention projections in closed form. By fine‑tuning with pathway‑level auditing losses and orthogonal gradient projection, AVCE reduces attack success rates by 5.07× and improves auditing scores by 3.84× compared to the best baseline while maintaining generation quality.
arXiv:2609.37537v1 Announce Type: new Abstract: Machine unlearning has emerged as a critical post-hoc safety measure to erase sensitive concepts from Text-to-Image (T2I) models without prohibitive re...
arXiv:2607. 23492v1 Announce Type: cross Abstract: Concept erasure techniques (CETs) edit text-to-image diffusion models to erase undesired targets such as NSFW content or copyrighted styles, while preserving model utility on benign concepts.
arXiv:2609.09909v1 Announce Type: new Abstract: Although text-to-image diffusion models generally exhibit strong prompt-following ability, we identify a persistent and previously underexplored failur...
arXiv:2605.25765v2 Announce Type: replace-cross Abstract: Existing closed-form methods for concept unlearning in text-to-image diffusion models typically derive editing directions from fixed text emb...
TINA+ is a diffusion-consistent, text‑free inversion attack that probes residual visual knowledge in diffusion models after concept erasure. By using optimization‑based inversion and diffusion‑consistent trajectory regularization, it suppresses spurious trajectories that could falsely indicate retained concepts. Experiments across multiple erasure methods, tasks, and model architectures show that TINA+ reliably recovers erased concepts, revealing that many current techniques only sever text‑image links rather than eliminating underlying visual knowledge.
RASteer is a training‑free method for concept erasure in text‑to‑image diffusion models that retains other concepts. It constructs a retain subspace from concepts to preserve, then removes components aligned with this subspace from the erasure direction using Retain‑Orthogonal Steering (ROS). Overlap‑Adaptive Calibration (OAC) further adjusts the removal of shared components at each layer and denoising step, balancing target erasure with concept preservation. Experiments show RASteer matches or outperforms existing activation steering and weight editing baselines on unsafe‑content, instance, and artistic‑style erasure tasks across multiple backbones and benchmarks.
arXiv:2512. 02657v2 Announce Type: replace-cross Abstract: Real-world deployment of text-to-image diffusion models requires continual concept removal as new privacy, copyright, or safety obligations arise over time.
Training-free concept erasure is an attractive mechanism for controlling text-to-image diffusion models, but precise erasure often comes at the cost of damaging semantically related non-target concepts. Existing value-space methods remove the component of each cross-attention value along the target concept direction, implicitly treating target identity and shared visual structure as the same signal.
arXiv:2607. 06432v1 Announce Type: cross Abstract: Concept unlearning in text-to-image diffusion models is critical for safe and practical deployment: with rising privacy concerns, copyright disputes, trademark constraints, and safety regulations, deployed systems must be able to suppress unwanted concepts after training.
arXiv:2609.01433v1 Announce Type: new Abstract: Concept erasure aims to suppress unsafe, privacy-sensitive, or undesirable generations in text-to-image diffusion models while preserving benign semant...
The paper investigates how diffusion models, even after fine‑tuning to unlearn harmful concepts, still retain a linear residual of those concepts in token embeddings. It introduces SubAttack, a jailbreak method that extracts this residual by learning orthogonal attack tokens composed of interpretable textual elements, and SubDefense, a plug‑and‑play defense that projects out the same subspace to suppress the residual. Experiments show SubAttack outperforms prior attacks in power and transferability, while SubDefense offers stronger robustness and better preservation of safe generation quality.
EraseSAE is a framework for surgical concept erasure in text-to-video diffusion models. It uses a Partitioned Convolutional Sparse Autoencoder to decompose activations into interpretable sparse features, a contrastive attribution mechanism to isolate concept-specific kernels, and timestep‑resolved masks to confine erasure to active regions. Experiments show precise removal with minimal quality loss, outperforming existing methods.