PaperlayerView exact revision on arXiv

Source-linked AI summary

Erasing Concepts from Diffusion Models

Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman, David Bau

arXiv:2303.07345v3cs.CV

TL;DR

The paper addresses how to remove specific visual concepts from pretrained text-to-image diffusion models without costly retraining or easily circumventable output controls. It introduces ESD, which fine-tunes model weights using concept descriptions and negative guidance. ESD performs comparably to Safe Latent Diffusion for explicit-content removal, removes named artistic styles in user studies, and also supports object-class erasure, with trade-offs for large concepts.

  • Problem

    Pretrained text-to-image models can reproduce undesirable content and copyrighted artistic styles, while filtering, censored retraining, and inference guidance have cost or circumvention limitations.

  • Method

    ESD fine-tunes pretrained diffusion-model weights using only the target concept description, with cross-attention or non-cross-attention tuning selected for prompt-specific or global erasure.

  • Results

    ESD performs comparably to Safe Latent Diffusion for explicit-content removal, removes five modern artists’ styles with human-study support, and is applied to concrete object classes.

  • Takeaways & Limitations

    Editing model weights provides a fast concept-erasure approach that removes the need for post-inference filters and supports safe parameter distribution.

  • Takeaways & Limitations

    For large concepts such as object classes or some styles, complete erasure can interfere with other concepts, and some classes retain their larger concept after only distinctive attributes are erased.

Abstract

from arXiv · show

Motivated by recent advancements in text-to-image diffusion, we study erasure of specific concepts from the model's weights. While Stable Diffusion has shown promise in producing explicit or realistic artwork, it has raised concerns regarding its potential for misuse. We propose a fine-tuning method that can erase a visual concept from a pre-trained diffusion model, given only the name of the style and using negative guidance as a teacher. We benchmark our method against previous approaches that remove sexually explicit content and demonstrate its effectiveness, performing on par with Safe Latent Diffusion and censored training. To evaluate artistic style removal, we conduct experiments erasing five modern artists from the network and conduct a user study to assess the human perception of the removed styles. Unlike previous methods, our approach can remove concepts from a diffusion model permanently rather than modifying the output at the inference time, so it cannot be circumvented even if a user has access to model weights. Our code, data, and results are available at https://erasing.baulab.info/

1. Introduction

Text-to-image models can reproduce undesirable copyrighted styles and pornography, while existing filtering and inference controls have important cost or circumvention limitations. The paper proposes ESD, which edits pretrained model weights using only concept descriptions and evaluates safety, style, and object removal.

  • Text-to-image models trained on internet datasets can imitate copyrighted artistic styles and generate undesirable content such as pornography.
  • Stable Diffusion’s filter can be disabled, while censored retraining required 150,000 GPU-hours over the 5-billion-image LAION dataset.
  • ESD fine-tunes pretrained model parameters using only undesired concept descriptions, avoiding additional training data and full-system retraining.
  • The paper evaluates ESD on offensive-content removal, five modern artists, human perception of style removal, interference with other styles, image quality, and complete object classes.

2. Related Works

Prior work removes undesirable outputs through dataset censorship, post-generation filtering, inference guidance, image cloaking, or model editing. ESD instead edits diffusion-model parameters to erase a targeted concept from pretrained weights using a textual description.

  • Dataset censorship requires costly retraining and can produce unintended effects, whereas post-hoc filters and inference guidance are efficient but circumventable by users with model access.
  • Image cloaking protects artists by perturbing images before online publication, but it does not erase an artistic style already learned by a pretrained model.
  • Existing model-editing methods typically add or modify subjects, while this work targets erasure of a visual concept from a diffusion model using one textual description.
  • The approach is motivated by score-based composition, treating “A and not B” as a difference between log probability densities.

3. Background

Diffusion models generate images through sequential denoising from Gaussian noise, while latent diffusion performs this process in a lower-dimensional encoded space. Classifier-free guidance combines conditional and unconditional predictions to steer generation toward text conditions.

  • Diffusion models gradually denoise sampled Gaussian noise over T steps, producing intermediate states x_t and a final image x_0.
  • Latent diffusion adds noise to an encoded image latent and learns timestep- and text-conditioned noise predictions in a lower-dimensional space.
  • Classifier-free guidance jointly trains conditional and unconditional denoising and uses both scores during inference.
  • Inference repeatedly denoises from z_T ∼ N(0, 1) to z_0 before decoding the latent into image space.

4. Method

ESD edits a pretrained Stable Diffusion U-Net using negative guidance from the model itself, requiring no additional data. Parameter choice controls whether erasure is prompt-specific or global, trading selectivity against broader removal.

  • 4. Method: ESD fine-tunes new U-Net parameters in a pretrained Stable Diffusion model to erase concepts using the model’s own knowledge without additional data.
  • 4. Method: The objective reduces the generation probability of images associated with the target concept by training conditional noise predictions toward negatively guided noise.
  • 4. Method: A frozen original model supplies conditioned and unconditioned noise predictions, which are combined to define the erasure target for the trainable model.
  • 4.1. Importance of Parameter Choice: Cross-attention responds directly to prompt text, whereas non-cross-attention parameters can represent visual concepts even when they are absent from the prompt.
  • 4.1. Importance of Parameter Choice: ESD-x tunes cross-attention for prompt-specific style erasure, while ESD-u tunes non-cross-attention layers for text-independent removal of global concepts such as nudity.
  • 4.1. Importance of Parameter Choice: For Van Gogh, ESD-x minimizes interference with other styles, whereas ESD-u removes style aspects globally across artistic styles.
  • 4.1. Importance of Parameter Choice: ESD-u performs best for NSFW removal because nudity must be erased even when it is not explicitly mentioned in the prompt.

5. Experiments

Experiments evaluate ESD-x for artistic-style removal and ESD-u for nudity and object-class erasure, comparing them with inference and retraining baselines. ESD removes targeted concepts while generally preserving unrelated content, but stronger or broader erasure can increase interference and incomplete removal.

  • Artistic Style Removal: ESD-x erases the styles of five modern artists while preserving prompt content and structure with minimal interference to other artistic styles.The artists are Kelly McKernan, Thomas Kinkade, Tyler Edlin, Kilian Eng, and “Ajin: Demi-Human.”
  • Artistic Style Removal: The user study used 13 participants, 40 real artworks and 40 style-invoking prompts per artist, with five-point ratings of perceived artist similarity.Participants rated confidence that each experimental image was created by the same artist as the reference artworks.
  • Artistic Style Removal: Average perceived-style ratings were 1.12 for ESD-x, 2.00 for SLD, and 2.22 for SD-Neg-Prompt, indicating stronger style removal by ESD-x.The original, similar-artist, and AI-generated reference averages were 3.85, 3.16, and 3.21, respectively.
  • Artistic Style Removal: ESD produces fewer effects on untargeted artistic styles than SLD and permanently modifies the model rather than relying on inference-time removal.Users were most likely to judge images generated with ESD as genuine artwork when prompts referenced an unerased artist.
  • Explicit Content Removal: On I2P prompts, ESD-u reduced nudity-classified images from 796 in Stable Diffusion v1.4 to 134 and outperformed the compared alternatives.The comparison included SLD and NSFW-filtered Stable Diffusion V2.0.
  • Explicit Content Removal: On COCO 30K, ESD showed better image fidelity than SLD and Stable Diffusion while all methods retained similar CLIP scores to Stable Diffusion.ESD-u denotes η = 1 and ESD-u-3 denotes η = 3; the dataset contains no nudity.
  • Object Removal: Object-class erasure usually removes targeted classes while retaining high accuracy on untargeted classes, but some classes remain difficult and can introduce distortions.Churches may retain larger concepts after distinctive attributes such as crosses are removed, while French-horn removal visibly distorts other classes.
  • Effect of η on Interference: Increasing η strengthens erasure but increases interference: η = 10 erases 92% of nudity cases and reduces object accuracy by 34%, versus 83% and 7% at η = 1.η = 3 provides an intermediate result, erasing 88% and impacting object accuracy by 14%; lower η also improves image quality.

6. Conclusion

The paper presents concept erasure by editing text-to-image model weights, avoiding extensive dataset manipulation and expensive retraining. It demonstrates applications in explicit-content removal, artistic-style removal, and object-class removal.

  • The approach eliminates specific concepts by directly editing text-to-image model weights.It requires neither large-dataset manipulation nor expensive training from scratch.
  • The method removes explicit content with results comparable to Safe Latent Diffusion.
  • The method removes artistic styles with support from a human study and also applies to concrete object classes.

Code

The supplementary materials provide implementation details, visualizations, datasets, baseline settings, and experimental analyses supporting the paper’s erasure method.

  • The supplementary materials include the objective-function visualization, dataset details, implementation details, image-erasure analysis, visual results, and user-study details.
  • The training objective reconstructs conditioned noise from the edited model using negatively guided noise from a frozen model.
  • The objective teaches the model to erase residual noise corresponding to the targeted concept.The residual is defined as the difference between frozen-model conditioned and unconditional noise.
  • Visualizing residual noise reveals styles and concept attributes in the image domain.

B. Implementation Details

Implementation uses negative-guidance fine-tuning for artistic-style, nudity, and object erasure, with Stable Diffusion and Safe Latent Diffusion baselines and CLIP/FID-based evaluation.

  • Artistic Style Erasure: For artistic-style erasure, ESD-x uses negative guidance 1, 1000 iterations, a 1e-5 learning rate, and the artist name as the erasure prompt.
  • Artistic Style Erasure: Artistic-style experiments compare ESD-x with SLD-Medium, Stable Diffusion v1.4, and Stable Diffusion using the artist name as a negative prompt.
  • Artistic Style Erasure: The artistic-style user study generates 1000 images for erased and similar artists and compares them with snapshots of the artists’ original work.
  • Evaluation: Evaluation uses NudeNet for nudity detection, CLIP for text-to-image alignment, and FID for image quality on the COCO-30k validation subset.
  • Object Erasure: For object erasure, ESD-u trains ten models on ImageNet’s Imagenette subset, each removing one of ten selected object classes.

C. Single Image Erasure

Single-image erasure removes a targeted artwork while largely preserving related style and unrelated artwork, whereas multiple-image erasure introduces interference; generic prompts reduce synonymous concepts.

  • Image-Specific Erasure: Image-specific erasure can use ground-truth images to generate partially denoised training inputs through the forward process.
  • Single Image Erasure: Erasing “Starry Night” has minimal effect on Van Gogh’s general style and other memorized artworks.
  • Multiple Image Erasure: Simultaneously erasing multiple images affects other memorized artwork while minimally interfering with non-artwork generations.LPIPS measures image changes, with higher scores indicating greater change.
  • Generic Prompts for Erasure: The generic-prompt experiment tests whether erasure responds to underlying meaning rather than only specific wording.
  • Generic Prompts for Erasure: Erasing a generic Eiffel Tower prompt reduces generations depicting the Eiffel Tower from 79 images to an average of 38.The experiment uses five paraphrased prompts and also finds similar effects when removing the main wording from synonymous prompts.
  • Nudity Erasure: The nudity-erasure table reports unsafe-content probabilities across categories for Stable Diffusion and Safe Latent Diffusion baselines.

E.1. Artistic Style

The study evaluates artistic-style erasure and interference using LPIPS, qualitative comparisons, and a user study across five modern artists. ESD-x removes the targeted style while preserving similarity to unrelated styles.

  • Style erasure and interference: LPIPS is higher for erased styles and lower for unrelated styles, indicating stronger intended change with less interference.The analysis compares edited and original Stable Diffusion images for both targeted and unrelated artistic styles.
  • User study: The user study evaluates style removal and interference using reference images, original Stable Diffusion generations, ESD-x, SLD, and SD-Neg-Prompt outputs.Participants rated generated images after viewing reference works from the erased artist and a similar artist.
  • User study results: ESD-x received the lowest similarity ratings for erased styles and the highest similarity ratings for styles that were not erased.Table F.1 reports averages with 95% error margins.

F.3. Analysis

The analysis presents user-study evidence, comparisons with prior safety methods, and qualitative demonstrations of artistic-style and object-class erasure. Across these examples, the figures emphasize intended removal alongside interference or preservation of other outputs.

  • User-study analysis: ESD-x shows minimum similarity for erased styles and maximum similarity for styles that are not erased, with 95% confidence intervals reported.This indicates targeted style removal with minimal measured interference in the user-study analysis.
  • Artistic-style erasure: The style-erasure figures mark intended removals on the diagonal and show unintended interference off the diagonal.The captions identify the blue dotted boxes as images with the intended style erased.
  • Artistic-style erasure: The artistic-style figures compare original Stable Diffusion, the proposed method, and SLD using prompts and seeds held constant.The first column shows unedited generations, while later columns show outputs from the proposed method and SLD.
  • Object-class erasure: The object-removal figures compare original Stable Diffusion generations with intended erasures across multiple object classes and show interference with other classes.The red-dotted rows contain erased outputs, with corresponding original images directly above them.
Loading 2303.07345v3…