PaperlayerView exact revision on arXiv

Source-linked AI summary

Erasing Concepts from Diffusion Models

Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman, David Bau

arXiv:2303.07345v3cs.CV

TL;DR

Text-to-image models can reproduce undesirable concepts, but prior approaches have centered on filtering or inference guidance rather than removing concepts from model weights. This paper fine-tunes pretrained models for concept erasure and reports explicit-content removal comparable to Safe Latent Diffusion, alongside artistic-style removal supported by a human study.

  • Problem

    Text-to-image models can imitate undesirable concepts, while prior approaches focus on filtering or inference guidance rather than selectively removing a concept from pretrained model weights.

    Source: §1 · p. 1

  • Method

    ESD fine-tunes a pretrained model’s parameters using descriptions of the undesired concept and the model’s own knowledge, without additional training data.

    Source: §1 · p. 2, §4 · p. 4

  • Results

    The authors report explicit-content removal comparable to Safe Latent Diffusion, artistic-style removal supported by a human study, and application to concrete object classes.

    Source: §6 · p. 8

  • Takeaways & Limitations

    Weight-level erasure avoids the need for post-inference filters and enables distribution of model parameters, according to the paper’s conclusion.

    Source: §6 · p. 8

    Erasing large concepts can trade off complete removal against interference with other concepts, and object-class erasure may leave concepts partly unerased while affecting other classes.

    Source: §5.5 · p. 8

Abstract

from arXiv · show

Motivated by recent advancements in text-to-image diffusion, we study erasure of specific concepts from the model's weights. While Stable Diffusion has shown promise in producing explicit or realistic artwork, it has raised concerns regarding its potential for misuse. We propose a fine-tuning method that can erase a visual concept from a pre-trained diffusion model, given only the name of the style and using negative guidance as a teacher. We benchmark our method against previous approaches that remove sexually explicit content and demonstrate its effectiveness, performing on par with Safe Latent Diffusion and censored training. To evaluate artistic style removal, we conduct experiments erasing five modern artists from the network and conduct a user study to assess the human perception of the removed styles. Unlike previous methods, our approach can remove concepts from a diffusion model permanently rather than modifying the output at the inference time, so it cannot be circumvented even if a user has access to model weights. Our code, data, and results are available at https://erasing.baulab.info/

1. Introduction

The paper proposes Erased Stable Diffusion (ESD), which fine-tunes a pretrained text-to-image model to erase concepts from its parameters. It evaluates ESD on offensive-image removal, artistic-style removal, and object-class erasure.

Introduction

  • On the 4,703-prompt I2P benchmark, SD 1.4 produced 796 detector-identified images with exposed body parts, versus 417 for SD 2.0.The passage notes that SD 2.0's training-set filtering required 150,000 GPU-hours, while explicit content remained prevalent in its outputs.Source: §1 · p. 2
  • Stable Diffusion can imitate specific artists’ styles, while adversarial artwork perturbation [42] cannot remove a style already learned by a pretrained model.The passage frames style imitation as a copyright concern and notes that related legal cases had yet to be decided.Source: §1 · p. 2
  • ESD is reported to remove offensive images as effectively as Safe Latent Diffusion.The authors also test removing artistic styles and complete object classes.Source: §1 · p. 2
  • ESD fine-tunes model parameters using only descriptions of the undesired concept, without additional training data or retraining the whole system.Unlike post-generation filtering or inference steering, parameter-level erasure is intended to resist circumvention even when users have access to the weights.Source: §1 · pp. 1–2
  • The authors assess artistic-style erasure through a user study of perceived style removal, interference with other styles, and image quality.They also test erasure of complete object classes.Source: §1 · p. 2

2. Related Works

Prior approaches either censor training data, modify outputs at inference, or edit models to add or alter content. This work instead uses score composition to fine-tune model weights to erase a visual concept from a single text description.

Undesirable image removal

  • Training-set censorship and inference-time safeguards are costly or easy to circumvent, while this work edits model weights using guidance [25] [39] [29] [38].The comparisons include Stable Diffusion 2.0, retrained on censored data, and Safe Latent Diffusion [38], a guidance-based approach.Source: §2 · p. 2

Image cloaking

  • Unlike image cloaking, which lets artists hide their work through adversarial perturbations, this method erases concepts without requiring content providers to self-censor [36] [42].Cloaked images can confuse models while remaining visible to humans.Source: §2 · p. 2

Model editing

  • Prior editing methods modify facts or image generators, and diffusion methods add subjects from few images [7] [23] [8] [24] [14] [2] [13] [20] [35]; this work erases concepts from one description.The target may be a concept, object, or style.Source: §2 · pp. 2–3

Memorization and unlearning

  • Machine unlearning simulates removing identified training examples [40] [15], whereas this work targets high-level concepts learned from large, unknown subsets of data, such as nudity or an artist’s style.Exact and unintentional memorization in large models, including diffusion models, has motivated privacy and copyright concerns [6] [5] [45].Source: §2 · p. 3

Energy-based composition

  • Building on score composition for “A and not B” [11] [22], this work uses score composition as unsupervised training data to erase concepts from weights rather than composing at inference [18] [38].The composition treats the phrase as the difference between log probability densities for A and B.Source: §2 · p. 3

3. Background

Diffusion models generate images through iterative denoising, while latent diffusion models perform that process in a text-conditioned, lower-dimensional latent space and use classifier-free guidance to steer generation.

3.1. Denoising Diffusion Models

  • Diffusion models start from Gaussian noise and predict noise over T denoising steps, forming an image through Markov transitions [17].Source: §3.1 · p. 3

3.2. Latent Diffusion Models

  • Latent diffusion models [31] add noise to VAE-encoded image latents and train shared denoising parameters to predict it conditioned on timestep and text.Inference denoises from zT to z0, then decodes z0 into an image.Source: §3.2 · pp. 3–4
  • Classifier-free guidance jointly trains conditional and unconditional denoising, then steers inference toward the conditioned score and away from the unconditioned score with α > 1 [18].Source: §3.2 · pp. 3–4

4. Method

The method erases concepts by fine-tuning a pretrained diffusion U-Net toward negatively guided predictions, using the model’s own knowledge to synthesize training samples without additional data. It chooses which parameters to tune based on whether erasure should be prompt-specific or global.

4. Method

  • The method fine-tunes a pretrained Stable Diffusion U-Net to reduce the probability of generating images associated with a target concept, without collecting additional training data.It uses negatively guided noise predictions as the fine-tuning target, steering the edited model’s conditional prediction away from the erased concept.Source: §4 · p. 4
  • Training synthesizes samples conditioned on the target concept, then tunes new parameters against the frozen model’s combined conditional and unconditional noise predictions.The method samples partially denoised images with the trainable parameters, queries the frozen model both with and without the concept prompt, and linearly combines those predictions to negate concept-associated noise.Source: §4 · p. 4

4.1. Importance of Parameter Choice

  • Cross-attention tuning (ESD-x) targets prompt-specific erasure, while unconditional-layer tuning (ESD-u) targets erasure independent of the prompt.Cross-attention is linked to prompt text; other parameters can contribute to a visual concept even when it is not mentioned.Source: §4.1 · p. 4
  • For styles, ESD-x removes the named style with minimal interference, whereas ESD-u erases style aspects across other artistic styles; ESD-u performs best for globally removing nudity.The nudity evaluation includes prompts that do not explicitly mention NSFW terms.Source: §4.1 · p. 5, Figure 4 · p. 5

5. Experiments

The experiments test permanent concept erasure through fine-tuning: ESD-x updates cross-attention for style removal, while ESD-u updates unconditional U-Net weights. Across artistic styles, nudity, and object classes, results show effective targeted erasure alongside trade-offs in interference, image quality, and completeness.

5. Experiments

  • Experiments used 1,000 gradient steps, batch size 1, and learning rate 1e-5; ESD-x fine-tuned cross-attention and ESD-u fine-tuned unconditional U-Net weights.The experiments used Stable Diffusion 1.4 unless specified otherwise.Source: §5 · p. 5

5.1.1 Experiment Setup

  • For the five styles, ESD-x preserved prompt content and structure with minimal interference, and users were more likely to consider its untargeted-style images genuine than images from SLD [38] or SD-Neg-Prompt.Unlike the inference-time baselines, ESD-x modifies the model permanently.Source: §5.1.1 · p. 5, Figure 5 · p. 6, §5.1.2 · p. 6

5.1.2 Artistic Style Removal User Study

  • The study covered five artists or topics, with 40 real artworks and 40 style prompts per artist; 13 participants rated images on a five-point scale.The evaluation dataset contained 1,000 generated images, and participants judged whether each experimental image appeared to share an artist with five real artworks.Source: §5.1.2 · pp. 5–6
  • ESD-x received the lowest perceived-style rating (1.12, versus 2.00 for SLD [38] and 2.22 for SD-Neg-Prompt), while ESD-u reduced nudity-positive images from 796 to 134 and outperformed SLD [38] and SD V2.0.For nudity, the evaluation used 4,703 I2P-prompt images and the weak erasure setting η = 1; the reported reduction covers images with exposed body parts.Source: Figure 6 · p. 6, §5.1.2 · p. 6, Figure 7 · p. 7

5.2. Explicit Content Removal

  • On COCO 30K, ESD-u showed better image fidelity than SLD [38] and Stable Diffusion, while all methods had similar CLIP scores to Stable Diffusion.The comparison used inference guidance α = 7.5; ESD-u with η = 1 and ESD-u-3 with η = 3 were evaluated.Source: Table 1 · p. 7, §5.2 · p. 7

5.3. Object Removal

  • ESD-u removed targeted Imagenette classes in most cases, though church was harder to erase; untargeted-class accuracy remained high but some distortions occurred, including after removing French horn.The evaluation generated 500 images per class and measured top-1 predictions with a pretrained ResNet-50 ImageNet classifier.Source: §5.3 · pp. 7–8, Table 2 · p. 8

5.4. Effect of η on Interference

  • For nudity erasure, η = 10 removed 92% of cases but reduced object-class accuracy by 34%; η = 3 removed 88% with a 14% impact, and η = 1 removed 83% with a 7% impact.Lower η mitigated interference and improved image quality but reduced erasure efficacy, so the suitable setting depends on the application.Source: §5.4 · p. 8

5.5. Limitations

  • Erasing large concepts can trade completeness for interference: some object classes are only partly erased, while some unrelated classes or artistic styles are affected.Examples include removing only distinctive attributes such as church crosses or parachute ribs, and occasional interference with other artistic styles.Source: §5.5 · p. 8, Figure 8 · p. 8

6. Conclusion

The paper proposes a fast method for erasing named concepts from text-to-image models by editing their weights, avoiding dataset filtering, expensive retraining, and post-inference filters. It demonstrates the approach on explicit content, artistic styles, and object classes.

6. Conclusion

  • The method erases a named concept directly from model weights without large-dataset manipulation or expensive training, enabling safe parameter distribution without post-inference filters.It requires only the name of the concept to remove.Source: §6 · p. 8
  • The approach removes explicit content comparably to Safe Latent Diffusion, removes artistic styles supported by a human study, and also applies to concrete object classes.Source: §6 · p. 8

Code · Appendix · A. Visual Motivation

The appendix visualizes the residual-noise interpretation of the erasure objective and outlines supplementary implementation, experiment, and user-study materials. Code, data, and fine-tuned weights are available from the project website and GitHub repository.

Code

  • Source code, datasets, and fine-tuned model weights for reproducing the results are available on the project website and GitHub repository.The passage gives https://erasing.baulab.info and https://github.com/rohitgandikota/erasing.Source: Code · p. 9

Appendix

  • The supplementary materials cover dataset and implementation details for baselines and the proposed methods, plus the image-erasure experiment introduced in the main paper.Source: Appendix · p. 11
  • They also provide visual results for artist and object erasure and details of the user study.Source: Appendix · p. 11

A. Visual Motivation

  • The training objective reconstructs the negatively guided noise from a frozen model using the edited model’s conditioned noise.The loss compares conditioned noise from the edited model θ with negatively guided noise from the frozen model θ∗.Source: A. Visual Motivation · p. 11
  • Figure B.1 visualizes concept-specific residual noise, sampled at t=10 and amplified tenfold before decoding through the VAE.The condition c is shown in quotes, and the amplified residual is passed through decoder D.Source: A. Visual Motivation · p. 11
  • The residual scores represent concept styles and attributes; negating them from unconditional noise naturally leads to a distribution without those concepts.Source: A. Visual Motivation · p. 11

B. Implementation Details … B.3. Object Erasure

The implementation uses ESD with negative guidance for artist-style, nudity, and object erasure, with training prompts and evaluation setups tailored to each task. The supplied passages describe methods and evaluation protocols, not comparative results.

B.1. Artist Style Erasure

  • Artist-style erasure uses ESD-x with negative guidance 1, fine-tuned for 1000 iterations at learning rate 1e-5 using the artist’s name as the conditioning prompt.Baselines are SLD-Medium, Stable Diffusion v1.4, and SD-NegPrompt; the artist name replaces SLD’s default safety concept or serves as the negative prompt.Source: §B.1 · p. 11
  • The artist-style user study uses 1000 images from generic style prompts for erased and similar artists, alongside snapshots of the artists’ original work.Qualitative results use 500 images generated from 20 ChatGPT-provided prompts per artist.Source: §B.1 · p. 11

B.2. Nudity Erasure

  • For nudity erasure, the main method is ESD-u with negative guidance 1; it uses the prompt "nudity" and trains for 1000 epochs at learning rate 1e-5.Baselines are SLD (Weak, Medium, and Max) and Stable Diffusion (v1.4, v2.0, and v2.1).Source: §B.2 · p. 11
  • Nudity evaluation generates 4703 images from the i2p prompts and seeds using classifier-free guidance 7.5.The dataset is proposed by SLD.Source: §B.2 · p. 11
  • Nudity evaluation uses Nudenet to assess changes in detected nudity versus original SD-v1.4 across nine exposed-body-part classes, selected from 16 classes with covered and exposed parts.CLIP measures text-to-image alignment, while FID measures image quality using the COCO-30k validation subset and clean-fid implementation.Source: §B.2 · pp. 11–12

B.3. Object Erasure

  • Object erasure uses ESD-u with negative guidance 1, training one model per selected ImageNet class for 1000 epochs at learning rate 1e-5.The ten classes are tench, English springer, cassette player, chain saw, church, French horn, garbage truck, gas pump, golf ball, and parachute; each class name is the training prompt.Source: §B.3 · p. 12

C. Single Image Erasure · D. Generic Prompts for Erasure

Single-image erasure can target a specific artwork with minimal effects on related style and other memorized art, while erasing multiple artworks can interfere with other memorized art; generic-prompt erasure also reduces synonymous-concept generations.

C. Single Image Erasure

  • For image-specific erasure, the method uses the original image to generate a partially denoised image through the forward process instead of model-generated conditional images.The same algorithm is used with this change to the training-image source.Source: C. Single Image Erasure · p. 12
  • Erasing “Starry Night” effectively removed that image while minimally affecting Van Gogh’s style and other memorized artworks.The reported effect is a finer level of erasure than removing the artist’s style or other memorized art.Source: C. Single Image Erasure · p. 12, Figure C.1 · p. 12
  • Erasing multiple artwork images affected other memorized artworks but had minimal impact on non-artwork generations, as measured with LPIPS.Higher LPIPS scores represent greater image change; the analysis used default AlexNet-based settings.Source: C. Single Image Erasure · p. 12, Figure C.2 · p. 12

D. Generic Prompts for Erasure

  • The generic-prompt experiment applied ESD-x to five paraphrases of the Eiffel Tower concept and generated 100 images directly referencing “Eiffel Tower.”The paraphrases included “Parisian Iron Lady” and “A famous landmark of Paris.”Source: D. Generic Prompts for Erasure · p. 12
  • Erasing a generic prompt reduced generations of its synonymous concept, indicating that the method responds to underlying meaning rather than only specific words.The tested prompts paraphrased the Eiffel Tower concept; the reverse wording experiment yielded similar results.Source: D. Generic Prompts for Erasure · p. 12
  • 79 original images depicted the Eiffel Tower, compared with an average of 38 images from models erasing synonymous prompts.The reverse experiment—removing the main wording and testing synonymous prompts—produced similar results.Source: D. Generic Prompts for Erasure · p. 12, Figure C.3 · p. 13

E. Extended Experimental results … F.2. User Interface

The extended experiments assess style erasure and interference, nudity and object removal, and a user study of perceived style similarity. The study design and interface support ratings of erased and unrelated artists’ styles.

E. Extended Experimental results / E.1. Artistic Style

  • LPIPS is higher for erased styles and lower for unrelated styles, indicating style removal with minimal interference across five artists.The analysis covers Andy Warhol, Van Gogh, Pablo Picasso, Rembrandt, and Caravaggio.Source: Table E.1 · p. 13, §E.1 · p. 13

E.2. Nudity

  • ESD-u-1 trained to erase “nudity” is reported to erase nudity more efficiently across all categories than the compared settings and baselines.The comparison includes SLD Weak, Medium, and Max and Stable Diffusion v2.0 and v2.1; inappropriate-category proportions use Nudenet and Q1611 classifiers.Source: §E.2 · pp. 13–14

E.3. Objects

  • The object experiments show class removal, interference with other classes, and intended erasure across various object classes.The results are presented in Figures F.12–F.14.Source: §E.3 · p. 14

F. User Study / F.1. Design

  • The user study tests style removal and interference by asking participants to rate how confidently images appear to be real works by a selected artist.For each artist, participants see five reference works and rate images on a one-to-five scale; there are 36 evaluations per artist across five artists, or 180 images total. Table F.1 reports that the method’s images are least similar to the erased artist’s style while retaining high similarity to other styles.Source: §F.1 · p. 14, Table F.1 · p. 14

F.1. Design

  • Each artist’s 36 evaluations draw images from nine buckets, including real-art references, original Stable Diffusion generations, erased-style models, and interference tests.The erased-style models are ESD-x, SLD, and SDNG; interference tests use models edited to remove other artists’ styles.Source: §F.1 · p. 14

F.2. User Interface

  • The interface shows artist reference images beside the image being rated, four rating radio buttons, and remaining-case and remaining-artist counts.Before proceeding, participants receive study participation and navigation instructions and acknowledge receipt of information about eligibility and IRB compliance.Source: §F.2 · p. 14

F.3. Analysis

The analysis reports that ESD-x minimizes similarity to erased styles while preserving similarity to unerased styles, and visual examples show intended style erasure with limited interference.

F.3. Analysis

  • ESD-x shows the minimum similarity for erased styles and maximum for unerased styles, indicating minimal interference; Table F.1 reports 95% confidence intervals.The passage does not provide the numerical similarity values.Source: §F.3 · p. 14
  • Visual examples show significant artistic-style erasure compared with SLD, with complete intended-style erasure and minimal interference across the remaining examples.Blue dotted boxes mark intended erasures; off-diagonal images show unintended interference.Source: Figure F.4 · p. 17, Figure F.5 · p. 17, Figure F.6 · p. 18

Related papers

Loading 2303.07345v3…