Source-linked AI summary
Continual Concept Erasure in Diffusion Models by Suppressing Cross-Edit Interference
Yongliang Wu, Haori Lu, Jinqi Luo, Wei Cao, Xingyu Zhu, Yaoyao Liu
TL;DR
Continual concept erasure must handle incoming targets without undoing previous deletions or degrading unrelated generations, yet updates can accumulate interference beyond finite retain sets. CEASE adds two subspace constraints to a closed-form solver, and across celebrities, styles, and instances it achieves the most consistent erase–preserve trade-off.
Problem
In continual erasure, existing methods do not constrain cross-edit interference, which can accumulate beyond finite retain sets and degrade unrelated generations or prior replacements.
Source: §1 · p. 1Method
CEASE is a training-free closed-form editing method that preserves the shared replacement representation and projects updates away from dominant output directions of past edits.
Source: §1 · p. 2Results
Takeaways & Limitations
For the tested continual erasure tasks, CEASE maintains a favorable balance between altering erased concepts and preserving retained concepts and unrelated generation.
Source: §4.2 · p. 6Experiments cover Stable Diffusion-family models and sequences of at most 100 edits; extending the constraints to training-based methods and substantially longer streams remains future work.
Source: §5 · p. 9
Abstract
from arXiv · showhide
Concept erasure removes copyright-protected, privacy-sensitive, or otherwise undesirable concepts from pretrained text-to-image diffusion models to support content governance and compliance. As erasure requests arrive over time, models must remove new targets without undoing prior erasures. Existing methods do not constrain interference across edits: residual perturbations outside the retain set interact and accumulate, degrading unrelated generations and sometimes collapsing previously erased targets into noise. We propose CEASE (Continual Erasure via Adaptive Subspace Editing), a training-free method that imposes two subspace constraints on a closed-form solver. CEASE adds the token representation of the shared replacement to the solver's invariance matrix and, when interference is detected, projects the current update onto the orthogonal complement of dominant output directions extracted from cumulative past updates. A closed-form decomposition attributes the accumulated interference to repeated activation of the shared replacement and overlap between successive update directions, showing that the two constraints suppress these respective sources. Across continual erasure of celebrities, artistic styles, and instances, CEASE achieves the most consistent erase-preserve trade-off, while existing methods either degrade general generation or insufficiently erase targets.
1 INTRODUCTION
Continual erasure must remove incoming targets without undoing prior erasures or degrading unrelated generations, but cross-edit interference can accumulate beyond finite retain sets. CEASE uses two subspace constraints to address distinct sources of that interference.
1 INTRODUCTION
- Continual requests require removing new concepts without undoing prior erasures or degrading unrelated generations, a challenge reported for sequential erasure.Existing methods can corrupt unrelated scenes and produce noise instead of the prescribed replacement for previously erased targets.Source: §1 · pp. 1–2
- Finite retain sets leave embeddings outside their span exposed to perturbations that interact across edits, cumulatively harming general generation and prompt-semantic alignment.After 100 edits, baseline CLIP scores fall below the unedited model, and generations can fail on both unrelated scenes and erased targets.Source: §1 · pp. 1–2
- CEASE adds the shared replacement token to the closed-form solver’s invariance matrix and projects updates away from dominant output directions of past edits when interference is detected.A closed-form decomposition attributes interference to repeated activation of the shared replacement and overlap between successive update directions; the two constraints suppress these respective sources.Source: §1 · p. 2
- Across celebrities, styles, and instances, CEASE achieves the best erase–preserve balance; on style erasure, it reduces COCO FID by 73% relative to the strongest prior method.The evaluation also reports stable COCO FID through the edit sequence and a COCO CLIP score close to the unedited reference after 100 edits.Source: §1 · p. 2
2 RELATED WORK
Related work spans training-based, editing-based, and non-parametric concept erasure, alongside sequential unlearning methods. This study focuses on cross-edit interference in repeated diffusion-model erasure, a setting distinct from the usual evaluation with all targets known in advance.
2 RELATED WORK
- Training-based methods fine-tune with suppression and preservation objectives, while adversarial-prompt hardening forms a separate strand (Gandikota et al., 2023; Fan et al., 2024).Each new target requires another fine-tuning loop.Source: §2 · pp. 2–3
- Editing methods such as TIME (Orgad et al., 2023) and UCE (Gandikota et al., 2024) update cross-attention by closed-form least squares, but preservation depends on a finite retain set.These methods edit the model in seconds.Source: §2 · p. 3
- Non-parametric methods leave weights unchanged and intervene at sampling time (Schramowski et al., 2023; Das et al., 2024; Rando et al., 2022).Source: §2 · p. 3
- Concept-erasure families are typically evaluated with the full target set known before editing; this study instead repeatedly edits a model that has already been changed.Source: §2 · p. 3
- Diffusion unlearning work adds masking with distillation, semantic gradient projection, or multi-objective distillation, but treats degradation as a whole rather than analyzing its sources (Li et al., 2025; Lee et al., 2026; George et al., 2025).Related sequential unlearning methods also include approaches for factual associations, where edits do not share a common redirection target.Source: §2 · p. 3
3 ANALYSIS AND METHOD
This section formalizes sequential closed-form erasure and analyzes why edits accumulate unintended output changes. It uses that decomposition to motivate CEASE’s anchor-invariance and historical-orthogonality constraints.
3.1 PROBLEM SETUP
- The base closed-form update redirects targets toward anchors while preserving non-targets, but its near-null projection protects only the finite retain-set span.Source: §3.1 · p. 3
3.2 WHY UPDATE NOISE ACCUMULATES
- A rank-one analysis attributes accumulated noise to repeated shared-anchor activation and cross-edit influence overlap; orthogonal influence directions remove inter-edit cross terms.Source: §3.2 · p. 4
3.3 CEASE: SUPPRESSING UPDATE NOISE
- AIC appends the anchor token embedding to the invariance matrix, enforcing Δ_i c*=0 up to numerical precision and removing anchor-linked components.Source: §3.3 · p. 5
- HOC uses dominant left singular directions of cumulative historical edits as a proxy for past output directions, projecting updates away when history substantially affects the current target.Both constraints reuse the closed-form update and require no retraining.Source: §3.3 · pp. 5–6, Figure 2 · p. 5
4 EXPERIMENTS
After 100-step continual erasure, CEASE achieves the most favorable erase–preserve balance across celebrities, styles, and instances. The experiments also compare task-specific outcomes and ablate components, editing scope, and cross-edit interference.
4.1 EXPERIMENTAL SETUP
- The benchmarks pair 100 erased concepts with 100 disjoint retained concepts and use five prompts per concept; metrics assess alignment, distribution and image distances, and task-specific accuracy or aesthetics.Main experiments use Stable Diffusion v1.4; the paper also reports results on v1.5 and v2.1 with the same conclusions.Source: §4.1 · p. 6, §4.2 · p. 8
4.2 MAIN RESULTS
- Across all three tasks, CEASE best balances erasure with preservation, keeping retained concepts and unrelated generations close to the unedited model.Baselines that erase more deeply also corrupt retained concepts or MS-COCO prompts.Source: §4.2 · p. 6, Table 2 · p. 7, Table 3 · p. 7
- For celebrities, CEASE preserves retain and COCO metrics while the VLM judge almost never names erased identities; for styles, it leads on retain metrics and COCO CLIP; for instances, it leads on retain and COCO preservation while altering erased concepts.UCE and RECE collapse celebrity retain scores; Sculpting Memory trades a lower COCO FID for a more degraded style retain set; deepest-erasing instance baselines lose both erase and retain accuracy.Source: §4.2 · p. 7
- On the celebrity, retained, and unrelated COCO examples, CEASE redirects the erased target to a coherent substitute while preserving the retained concept and scene.Other methods variously collapse outputs, distort or replace the retained identity, or leave the erased target recognizable.Source: §4.2 · p. 7, Figure 3 · p. 8
4.3 ABLATION STUDY
- Combining AIC and HOC performs best on retain and COCO metrics; AIC alone contributes the larger preservation gain, without the full method failing to erase celebrities.The full method redirects erased celebrities to coherent anchor substitutes rather than removing them more weakly.Source: Table 4 · p. 8, §4.3 · p. 8
- Low-resolution and all-stage scopes erase effectively with similar preservation, while middle- and high-resolution scopes preserve non-target behavior but fail to erase; All Stages erases strongest.The authors use All Stages as the default.Source: §4.3 · p. 8, Figure 4 · p. 9
- Across 100 celebrity edits, CEASE stays below SPEED on all three interference diagnostics and near zero on the shared replacement; UCE’s shared-replacement interference ends three orders of magnitude above CEASE.Value-projection interference alone does not rank preservation across methods.Source: §4.3 · p. 8, Figure 5 · p. 9
- At every checkpoint, CEASE has a higher COCO CLIP score and lower FID than SPEED.These measurements use saved checkpoints from complete sequential runs.Source: §4.3 · p. 9
5 CONCLUSION
CEASE addresses cross-edit interference in continual concept erasure and achieves the most consistent erase–preserve trade-off across celebrities, artistic styles, and instances on multiple backbones. The study is limited to the Stable Diffusion family, closed-form solvers, and sequences of up to 100 edits.
5 CONCLUSION
- CEASE achieves the most consistent erase–preserve trade-off across celebrities, artistic styles, and instances on multiple backbones.The framework protects the shared anchor and steers each new update away from directions perturbed by past edits.Source: §5 · p. 9
- Experiments focus on the Stable Diffusion family; extending CEASE to architectures such as FLUX is left as a next step.The authors describe extension to FLUX as a natural next step.Source: §5 · p. 9
- The proposed constraints are instantiated in a closed-form solver, while generalization to training-based erasure methods remains future work.Source: §5 · p. 9
- The evaluated sequences contain up to 100 edits; substantially longer streams are computationally expensive because each added step requires regenerating and reevaluating thousands of images.Source: §5 · p. 9
A.1 IMPLEMENTATION DETAILS
The implementation details specify how seven comparison methods are configured for continual erasure, spanning fine-tuning, closed-form edits, gradient projection, and memory-based unlearning.
A.1 IMPLEMENTATION DETAILS
- ESD-x fine-tunes cross-attention projections for 200 Adam iterations per step at learning rate 1 × 10−4, while ConAbl uses 100 iterations per concept at the same learning rate.ESD uses negative guidance with strength 1.0 and training latents generated at guidance 3.0 over 50 DDIM steps; ConAbl uses prior-loss weight 1.0.Source: §A.1 · p. 14
- UCE applies one closed-form least-squares update per step, whereas RECE alternates a closed-form value edit with adversarial target-embedding derivation.UCE uses erase and preserve scales of 1.0 and regularization λ = 0.5; RECE uses 3 adversarial epochs, erase scale 1.0, preserve scale 0.1, and closed-form and adversarial regularization of 0.1.Source: §A.1 · p. 14
- SPEED redirects each target to the anchor and projects updates onto the null space of an augmented retain set; CEASE’s AIC additionally inserts the task anchor.Both use null-space threshold 0.1, retain scale 0.05, λ = 0, and 10 augmented retain samples per concept; SPEED uses the empty-prompt representation in its invariance matrix.Source: §A.1 · p. 14
- CUIG-GradProj adds semantic-aware gradient projection to ConAbl, while Sculpting Memory combines a dynamic parameter mask with distillation from the preceding model.CUIG-GradProj uses 200 auxiliary prompts and 2,000 iterations per request (1,000 for style); Sculpting Memory uses 100 generated images per path, 10 epochs, and updates its mask every 100 steps.Source: §A.1 · p. 14
A.2 NEAR-NULL PROJECTOR
SPEED builds a retain projector from the retain Gram matrix’s eigendecomposition and uses low-eigenvalue directions to approximate the null space of retain embeddings.
A.2 NEAR-NULL PROJECTOR
- SPEED constructs its retain projector from the eigendecomposition of the retain Gram matrix, selecting eigenvectors whose eigenvalues fall below threshold τ.Right-projecting an update with this projector places it in the approximate null space of retain embeddings, so (∆⋆P)C0 ≈0; experiments use τ = 0.1.Source: §A.2 · p. 14
A.3 BACKBONE GENERALIZATION TO STABLE DIFFUSION V1.5
On Stable Diffusion v1.5 with a second CLIP-L backbone, CEASE’s erase–preserve pattern transfers across all three tasks. It improves retain and COCO preservation over SPEED while still altering erased targets.
A.3 BACKBONE GENERALIZATION TO STABLE DIFFUSION V1.5
- On the second CLIP-L backbone, CEASE improves retain and COCO preservation metrics over SPEED on all three tasks while still altering erased targets.The full 100-step sequence was repeated on Stable Diffusion v1.5 for all tasks and baselines.Source: §A.3 · p. 14
- CEASE’s aesthetic scores on styles stay at the reference level on Stable Diffusion v1.5.Source: §A.3 · p. 14
- ConAbl attains lower COCO FID on celebrity and style but largely destroys retained concepts, while UCE and RECE erase deepest with collapsed retain sets.Source: §A.3 · p. 14
A.4 BACKBONE GENERALIZATION TO STABLE DIFFUSION V2.1
On Stable Diffusion v2.1, the hardest tested backbone, all methods erase more weakly and their margins narrow. CEASE improves retain and COCO preservation metrics over SPEED on all three tasks, with shallower erasure on several tasks.
A.4 BACKBONE GENERALIZATION TO STABLE DIFFUSION V2.1
- CEASE improves retain and COCO preservation metrics over SPEED on all three tasks, at the cost of shallower erasure on several tasks.The transfer study reports a consistent preservation advantage over SPEED across both text encoders.Source: §A.4 · pp. 14–15
- Stable Diffusion v2.1 is the hardest tested backbone: every method erases more weakly, and the margins narrow.It replaces CLIP-L with the 1024-dimensional OpenCLIP-H text encoder.Source: §A.4 · p. 14
- Some baselines preserve well while erasing weakly: UCE leaves most erased celebrities recognizable, and ESD leaves erased instances nearly intact.The comparison spans celebrity, style, and instance tasks on SD v2.1.Source: §A.4 · p. 14
A.5 ORDER ROBUSTNESS
Across additional qualitative comparisons, CEASE redirects erased targets coherently and stays visually closest to the reference on retained and unrelated prompts. The appendices also report small variation across erasure orders, seconds-level runtime, and limits on interpreting value-projection noise as a standalone quality measure.
A.5 ORDER ROBUSTNESS
- Variation across five random celebrity-erasure orders is small on every metric relative to between-method differences in the main tables.Each ordering covers the 100-target sequence with editing seed 0.Source: §A.5 · p. 15, Table 11 · p. 17
A.6 RUNTIME EFFICIENCY
- About 13 seconds per request keeps CEASE in the closed-form methods’ seconds-level regime, versus minutes for training-based methods.The runtime comparison uses one H100 GPU, and the per-request gap compounds over a continual sequence.Source: §A.6 · p. 15
A.7 ADDITIONAL QUALITATIVE COMPARISONS
- CEASE redirects erased targets to coherent anchor substitutes and stays visually closest to the reference on retained and COCO prompts across the compared backbones.ESD often leaves targets recognizable; several methods collapse to noise-like textures, while destructive baselines also corrupt retained or unrelated concepts.Source: §A.7 · pp. 15–16
A.8 SCOPE AND PROTOCOL OF THE EXPANDED NOISE COMPARISONS
- The expanded noise diagnostic covers 16 cross-attention value projections on frozen SD v1.4, but lower noise alone cannot rank erasure methods.It omits key projections and other trainable parameters; some methods show less value-projection noise than CEASE despite weaker generation quality. Fig. 13’s diagnostic averages over erased concepts so far and subtracts each concept’s own request.Source: §A.8 · p. 23