PaperlayerView exact revision on arXiv

Source-linked AI summary

MANCE: Manifold Aware Concept Erasure

Matan Avitan, Yoav Goldberg, Yanai Elazar

arXiv:2607.03973v1cs.LG

TL;DR

Concept erasure must remove a target attribute while preserving other information entangled with it. MANCE constrains erasure updates to the natural representation manifold, improving leakage–surgicality tradeoffs across text and vision settings and supporting the Manifold Constraint Hypothesis.

  • Problem

    Concept erasure seeks to remove a target attribute while preserving other encoded concepts, but entanglement makes interventions risk damaging them.

  • Method

    MANCE estimates a local manifold from natural representations and projects gradient-based concept-erasure updates onto that manifold.

  • Results

    Across 119 text-and-vision settings, MANCE improves leakage–surgicality tradeoffs over unconstrained updates and prior erasers under matched surgicality budgets.

  • Takeaways & Limitations

    The results support the Manifold Constraint Hypothesis for concept erasure: constraining interventions to the natural representation manifold can preserve other information while reducing leakage.

  • Takeaways & Limitations

    MANCE’s advantage may shrink when representations lack a structured lower-dimensional manifold, and local estimates degrade in sparse or strongly curved regions.

Abstract

from arXiv · show

Concept erasure aims to remove a target concept from a representation while preserving the other information encoded in it. This is difficult because representations encode many concepts that are often correlated with the erasure target, so removing the target risks damaging them. We propose the Manifold Constraint Hypothesis (MCH): if natural representations concentrate on a structured, lower-dimensional manifold, then interventions should be constrained to that manifold and better preserve other information encoded in the representation during interventions. We instantiate MCH in a new concept erasure method: MANifold aware Concept Erasure (MANCE). MANCE performs iterative updates to the representations using signals from a classifier that predicts a target concept. We estimate the manifold using representations obtained from natural inputs, and then we project the concept removal update to the estimated manifold. We perform extensive evaluation on 119 settings spanning text and vision, including 13 language models, three NLP concepts, and 40 CelebA-CLIP attributes. Employing MANCE on top of previous methods shows consistent improved leakage results. We also introduce MANCE+ and MANCE++, which prepend a closed-form erasure algorithm before employing MANCE, achieving better leakage--surgicality tradeoffs relative to matched full-space updates. MANCE++, our best method, achieves state-of-the-art results on nonlinear concept erasure. These results support MCH in the erasure setting: interventions should be constrained to the natural representation manifold.

1 Introduction

Concept erasure seeks to remove a target attribute from neural representations while preserving other encoded information, but entanglement and unknown protected concepts make this difficult. MANCE operationalizes the Manifold Constraint Hypothesis by constraining gradient-based erasure updates to the natural representation manifold.

  • Motivation: Neural representations encode diverse attributes, motivating removal of one concept while preserving everything else in the representation.Examples include semantic content, style, demographic information, task labels, gender, and toxicity.
  • Challenge: Concept entanglement from data correlation and superposition means intervening on one concept may negatively affect another.Profession information and gender are given as an example of correlated concepts.
  • Challenge: Because other concepts are usually unknown, erasure is difficult to formulate as constrained optimization that preserves them.The unknown protected concepts prevent directly specifying preservation constraints.
  • Manifold Constraint Hypothesis: MCH assumes natural representations lie on a manifold and predicts manifold-constrained interventions can erase the target effectively while preserving other encoded concepts.The hypothesis motivates restricting interventions to the natural representation manifold rather than intervening unconstrained in the full representation space.
  • MANCE: MANCE implements MCH through targeted gradient-based representation updates constrained to remain on the estimated natural representation manifold.The MANCE family comprises manifold-aware methods for nonlinear concept erasure and can be applied as an additional step to prior erasers.
  • Evaluation: 119 settings span text and vision, including 39 NLP settings across 13 language models and three concepts, plus 80 CelebA-CLIP settings across 40 image attributes.Applying MANCE to INLP, LEACE, and IGBP shows consistent erasure improvements while minimally harming other concepts.

2 Previous Work

Previous concept-erasure methods remove linearly or nonlinearly decodable concept information, while Obliviator additionally has a representation-dimensionality limitation. MANCE complements these methods by projecting erasure updates onto the natural-representation manifold to improve edit surgicality.

  • Concept erasure methods: Linear methods including INLP and LEACE target linearly decodable concept information, whereas IGBP and Obliviator remove nonlinear information.IGBP iteratively trains a nonlinear probe and retracts representations toward the current decision boundary; Obliviator projects out predictive directions in a random-Fourier-feature space.
  • Concept erasure methods: Obliviator does not guarantee that erased outputs preserve the original representation dimensionality.Its retained feature-space modes are selected through an eigenvalue problem, so the resulting dimension depends on the retained modes.
  • MANCE: MANCE is orthogonal to prior erasure advances and can be applied to any previous method by projecting erasure updates onto the natural-representation manifold.The authors use MANCE alongside previous concept-erasure methods and report improved surgicality across a wide range of settings.

3 The MANCE Algorithms Family

The MANCE family operationalizes the Manifold Constraint Hypothesis by iteratively erasing concepts along tangent directions estimated from natural representations. Its updates project nonlinear probe gradients onto locally supported manifold directions and cap each sample’s displacement to preserve the validity of the local approximation.

  • Manifold Constraint Hypothesis: MANCE implements the Manifold Constraint Hypothesis, which predicts that matched-effect manifold-constrained interventions preserve other encoded concepts better than unconstrained interventions.The method estimates a first-order manifold approximation from tangent directions obtained using natural inputs.
  • Manifold estimation: MANCE estimates each edited representation’s local tangent space from nearest natural-representation neighbors using mean-centered local PCA and the top r SVD directions.The tangent basis is recomputed at the current edited position, while neighborhoods remain drawn from the fixed natural representations.
  • Tangent erasure direction: At each round, MANCE fits a nonlinear concept probe, computes input gradients, and projects the erasure gradient onto the estimated tangent basis.The projected update is attenuated when the gradient has little support in the estimated tangent space.
  • Tangent erasure direction: MANCE spectrally weights tangent coordinates by their singular values, emphasizing directions well supported by nearby natural representations and reducing weight on thin directions.The experiments use α = 1.
  • Per-sample step size: MANCE chooses a separate λ_i for each sample as the largest feasible step under a local-neighborhood cap and hard upper bound λ_max.The cap enforces ∥x̃_i − x_i∥_2 ≤ ε · r_i, where r_i is the mean distance to the k nearest natural representations.

4 Experimental setup

The experiments evaluate concept erasure across 119 NLP and vision settings using target leakage and surgicality metrics, fixed control-degradation budgets, and comparisons against prior erasers and a no-tangent-constraint ablation.

  • Metrics: Target leakage S measures residual recoverability of the erased concept, with DS = S − Sfloor and values near the majority-vote baseline indicating successful erasure.A new nonlinear probe evaluates the edited representations; unless otherwise specified, it is a 2-layer MLP with hidden size h = 128, trained for 200 SGD steps with patience 3.
  • Metrics: Surgicality ∆Y measures the change in control-concept accuracy, where negative values indicate degradation and an ideal edit has ∆Y ≈0.The metric compares probe accuracy on original representations Yclean with accuracy on edited representations Yedit.
  • Settings and probe: Evaluations cover 119 settings: 39 NLP settings across 13 LLM families and three concepts, plus 80 CelebA-CLIP settings spanning 40 binary facial attributes and two surgicality regimes.The NLP evaluations use the 50%-depth layer, while the vision evaluations use final-layer pooled CLIP ViT-B/32 image embeddings.
  • Baselines and ablation: The comparison includes LEACE, LEACE + CovMatch, INLP, IGBP, Obliviator, and MANCE variants, while AmbCE++ removes MANCE++’s tangent projection and uses a global step size λ = 29.31.AmbCE++ retains the preprocessing and nonlinear probe loop but takes full-gradient steps in the full representation space.
  • Evaluation protocol: Methods are compared under DY budgets of 1, 3, 5, and 10pp, selecting the strongest target erasure that remains within each control-degradation limit.Coverage reports the fraction of settings with at least one within-budget edit, so leakage means must be interpreted together with coverage.

5 Results

Across 119 NLP and vision settings, MANCE consistently improves prior erasers, while MANCE++ achieves the strongest leakage–surgicality tradeoff and state-of-the-art nonlinear concept erasure. Results also support constraining edits to the natural representation manifold, with a measurable latency cost.

  • Evaluation: The evaluation spans 119 settings: 39 NLP settings across 13 language models and three concepts, plus 80 vision settings covering 40 CelebA attributes under two correlation regimes.The regimes use the five most- or least-correlated control attributes.
  • Improving prior erasers: Applying MANCE after prior erasers improves results across most settings and drives baseline target leakage close to chance at matched surgicality budgets.For LEACE at DY ≤1pp, leakage falls from 19.1 to 1.5pp; the passage also reports a 15.2-to-…pp reduction for another baseline.
  • MANCE++ results: MANCE++ outperforms all baselines in both modalities, remaining near chance across NLP budgets and combining high coverage with near-floor leakage in vision.In vision, high-coverage baselines leave 4–7pp leakage, whereas Obliviator has near-floor leakage but substantially lower coverage.
  • MANCE++ results: In the least-correlated vision regime, MANCE++ covers 39/40 and 40/40 attributes at DY ≤1pp and DY ≤3pp, versus 15/40 and 29/40 for Obliviator.In the most-correlated regime, MANCE++ covers 19/40 and 34/40 attributes, compared with 2/40 and 15/40 for Obliviator.
  • MANCE++ results: MANCE++ gains most where surgical erasure is hardest, reaching chance on gender for 3/13 versus 0/13 models at DY ≤1pp and 12/13 versus 0/13 at DY ≤5pp.The comparison is against Obliviator, with profession strongly correlated with gender.
  • Ablation and latency: Removing the manifold constraint leaves 6–10pp leakage and often provides no trajectory step within the surgicality budget, while MANCE takes about 458.8–474.9 seconds across variants.Closed-form preprocessing adds only a few seconds; roughly 50% of MANCE runtime comes from local SVDs and 40% from CPU–GPU transfers and projection.

6 Discussion

The discussion argues that representation interventions should respect model- and data-induced geometry beyond concept erasure, while identifying manifold estimation as MANCE’s main limitation and a promising direction for improvement.

  • MCH may extend beyond concept erasure to representation edits such as activation steering, which should respect jointly induced geometry rather than unconstrained modifications.
  • MANCE is limited by its local, first-order manifold estimate, despite using a cheap per-representation tangent space that transfers across models and modalities without per-setting tuning.
  • Better non-local and global manifold estimators could enable more surgical interventions and let one estimate serve different edits instead of being recomputed for each representation.
  • Improving manifold estimation and relating its quality to intervention guarantees is presented as a promising path toward geometry-aware interventions.

7 Conclusion

The paper proposes the Manifold Constraint Hypothesis and instantiates it in MANCE, which constrains concept-erasure updates to an estimated representation manifold. Across 119 text and vision settings, MANCE improves leakage–surgicality tradeoffs over unconstrained and prior erasure methods.

  • Conclusion: The Manifold Constraint Hypothesis predicts that manifold-constrained interventions preserve information beyond the erased concept.MANCE estimates the manifold from neighboring representations and confines nonlinear concept-probe updates to it.
  • Conclusion: MANCE evaluates across 119 settings spanning text and vision, including three NLP concepts, 13 language models, and 40 CelebA-CLIP attributes.The NLP concepts are sycophancy, gender, and safety.
  • Conclusion: MANCE improves leakage–surgicality tradeoffs relative to unconstrained updates and prior erasure methods under the same surgicality budget.These results support the Manifold Constraint Hypothesis for concept erasure.

Limitations … C NLP full per-setting breakdown

The paper measures erasure and preservation empirically under fixed probe and control-concept protocols, while identifying limitations in local manifold estimation and computational cost. Closed-form preprocessing removes mean-shift and variance-asymmetry signals before MANCE attacks residual nonlinear structure, with ablations and per-setting NLP breakdowns documenting its effects.

  • Limitations: Target leakage and surgicality are empirical measurements under a fixed nonlinear-probe and labeled-control-concept protocol, not guarantees of complete unrecoverability or preservation.Surgicality covers only the enumerated control concepts, not all information in the representation.
  • Limitations: MANCE estimates each local tangent space with k-nearest-neighbor PCA and TwoNN-selected rank, but accuracy degrades for sparse representations or strongly curved manifolds.The constraint helps only when representations concentrate on a structured, lower-dimensional manifold.
  • Limitations: MANCE is computationally heavier than one-shot affine erasers because each round requires k-NN queries, local SVDs, nonlinear-probe refitting, and neighbor queries at deployment.LEACE applies a single affine map, whereas MANCE repeats local computations during fitting and application.
  • A Closed-form preprocessing details: MANCE+ and MANCE++ first exhaust first- and second-moment concept signals in closed form, leaving the manifold-constrained loop to remove residual nonlinear information.The stages target structurally distinct mean-shift and variance-asymmetry signals.
  • A Closed-form preprocessing details: LEACE removes rank-1 cross-covariance and eliminates linear classification above majority-class accuracy while minimizing representation damage among affine projections.The method is fit on training representations and applied to all splits.
  • A Closed-form preprocessing details: The covariance-asymmetry stage adds a rank-2 projection using the top eigenvectors of ∆Σ, while retaining two eigenvectors across all 119 settings.The effective rank removed is at most 3, compared with d = 768 for CLIP and d ∈[896, 5376] across the 13 LLM hidden sizes.
  • B Closed-form preprocessing ablation: Sycophancy is exhausted by closed-form preprocessing, while the manifold loop reduces Gender’s residual from 14.8pp above floor to 1.0pp and Safety’s from 11.5pp to 0.2pp.Sycophancy’s mean NL is 0.563 versus a floor of 0.560, matching MANCE++ at 0.560.
  • C NLP full per-setting breakdown: The NLP per-setting breakdown covers 39 settings, four surgicality budgets, and seven shared method columns, selecting the in-budget trajectory step with smallest absolute signed deviation.Bold indicates the row-best method per setting and budget block within numerical precision.

D CelebA full per-attribute breakdown · E Hyperparameters

The CelebA breakdown shows MANCE++ is strongest at the tightest surgicality budget, where Obliviator frequently overshoots while MANCE++ remains in budget and reaches the majority-class floor. Hyperparameters are fixed across all 119 settings, with local rank determined by TwoNN and protected by a minimum rank of 8.

  • D CelebA full per-attribute breakdown: The full CelebA summary reports signed mean DS, coverage, and at-chance counts for each method and budget across both surgicality regimes.The selected trajectory step is the in-budget step with smallest |DS|.
  • D CelebA full per-attribute breakdown: MANCE++ is evaluated across all 40 CelebA attributes at four surgicality budgets alongside Clean and Obliviator, with majority-class floors shown per attribute.Hatched “N/A” bars indicate no in-budget step at the displayed DY budget, with clean un-erased values substituted.
  • D CelebA full per-attribute breakdown: At DY ≤1pp in the most-correlated regime, Obliviator overshoots on 38 of 40 high-correlation targets, while MANCE++ keeps 19 in budget and drives 15 to floor.The per-attribute nonlinear-probe plots identify this pattern through low MANCE++ bars and high or unavailable Obliviator bars.
  • D CelebA full per-attribute breakdown: The tightest budget, ≤1pp, produces the largest gap between MANCE++ and baselines and the most frequent Obliviator overshoot, including unavailable results on hardest entangled targets.Tabs. 6–8 report signed DS in percentage points at the best in-budget trajectory step for DY ∈{1, 3, 5}pp.
  • E Hyperparameters: The per-sample local-radius-capped λi removes the global λ, while remaining step-controlling hyperparameters are fixed without per-setting tuning across 119 settings.The settings comprise 39 NLP and 80 CelebA configurations, and the fixed values apply to every method in Tab. 2.
  • E Hyperparameters: Fixed settings include ε=0.1, h=512, 800 probe-training steps, refits every 8 outer iterations, H=60, kmin=8, λmax=64, CovMatch rank 2, and α=1.These values specify the local-radius fraction, probe architecture and schedule, iteration count, intrinsic-dimension floor, λi safety cap, covariance rank, and local-σ exponent.
  • E Hyperparameters: The local tangent-basis rank r is estimated once from clean representations with TwoNN and held fixed throughout the iterative loop, subject to the floor kmin=8.TwoNN is intended to capture nearby-representation variance without absorbing noise; the floor guards against collapsed estimates on small or noisy pools.

F Computational cost

MANCE has the highest computational cost, requiring roughly eight minutes per panel because it repeatedly estimates local tangent bases and refits its nonlinear scorer. Its closed-form variants add only a few seconds, while LEACE and CovMatch complete in seconds.

  • Runtime: MANCE is the most expensive method, taking 458.8–474.9 seconds per panel across MANCE, MANCE+, and MANCE++.The methods are timed sequentially on one NVIDIA B200 GPU with 8 CPU cores using canonical configurations.
  • Runtime: Each MANCE round re-estimates a local tangent basis per row and periodically refits the nonlinear scorer.Tangent estimation uses kNN against the fixed natural reference X(0), followed by batched SVD.
  • Runtime: MANCE+ and MANCE++ add only a few seconds of closed-form preprocessing, increasing runtime from 458.8 to 470.5 to 474.9 seconds.These timings correspond to MANCE, MANCE+, and MANCE++, respectively.
  • Runtime: LEACE and CovMatch are substantially cheaper one-shot baselines, requiring 3.7 and 7.3 seconds, respectively.The comparison uses the same fit-and-apply timing path, excluding diagnostic probes used only for logging trajectories.

G Why ε = 0.1 transfers across panels … J Empirical support for the manifold premise

The appendices explain why MANCE uses a transferable local-radius fraction, how CelebA surgicality controls are constructed, and how per-row steps and intrinsic-dimension diagnostics support its manifold premise. Together, these sections specify adaptive intervention scaling, complementary preservation tests, matched-step analysis, and direct geometric validation.

  • G Why ε = 0.1 transfers across panels: MANCE uses ε = 0.1 to cap each sample’s displacement at a fraction of its local neighborhood radius across 39 NLP and 80 CelebA settings.The radius is recomputed each round from fixed natural representations, so the budget follows the edited point’s location.
  • G Why ε = 0.1 transfers across panels: Per-row local-radius scaling adapts displacement to panel-specific representation scales and within-panel density, unlike a global step that can over-edit dense rows or under-edit sparse rows.This yields small moves in dense neighborhoods and larger moves in sparse neighborhoods.
  • H CelebA control-set construction (least- vs. most-correlated five attributes): CelebA evaluates each of 40 target attributes using five least-correlated and five most-correlated controls selected from the remaining 39 attributes.The controls are ranked by absolute empirical Pearson correlation on the training split, excluding the target itself.
  • H CelebA control-set construction (least- vs. most-correlated five attributes): The two CelebA regimes distinguish preserving unrelated features from preserving correlated downstream information, revealing failures that either regime alone can conceal.A destructive method may pass least-correlated controls but fail most-correlated controls, whereas no-erasure methods can pass both.
  • I Closed-form per-row λi statistics: Each outer iteration produces per-row λi values capped at λmax = 64, with distributions averaged over 60 trajectory iterations and then aggregated across settings.These statistics characterize the closed-form step rule used inside the manifold-constrained loop.
  • I Closed-form per-row λi statistics: ¯λ ≈29.31 matches the effective step magnitude assigned to AmbCE++ in Tab. 2, isolating tangent-projected versus full-space gradient direction as the remaining comparison axis.The matched-step comparison controls for step magnitude between the unconstrained full-space method and MANCE++.
  • J Empirical support for the manifold premise: The manifold premise is tested independently of erasure outcomes using local intrinsic dimension and angles between global and local concept directions for sycophancy and gender.Tab. 13 uses TwoNN intrinsic-dimension estimates and compares the primary nonlinear case with a diagnostic linear baseline.

K Anisotropy regimes for the local-σ spectrum

The anisotropy exponent α controls how local-PCA singular values shape the tangent update direction, while the local-radius budget independently scales its magnitude. α=0, 1, and 2 define progressively stronger weighting toward high-σ tangent axes, with α=1 as the paper’s default.

  • Role of α: α controls how singular values σ_i,k of the mean-centered local PCA matrix shape the tangent direction d_i.The local-radius budget is direction-agnostic, so α provides direction awareness in the local spectrum.
  • Anisotropy regimes: α = 0 uses the bare projected unit gradient, so the singular spectrum does not shape the tangent direction.This treats tangent directions equally in the update direction.
  • Anisotropy regimes: α = 1, the paper’s default, reweights tangent directions by σ_i,k, assigning more step mass to high-σ axes and less to thin axes.The spectrum is used directly rather than ignored.
  • Anisotropy regimes: α = 2 reweights tangent directions by σ_i,k^2, strengthening emphasis on high-σ principal axes and reducing motion along low-σ thin tails.High-σ axes have more manifold support and more reliable local linear approximations, whereas thin directions more easily leave the manifold.
Loading 2607.03973v1…