Paper deep dive

MACE: Mass Concept Erasure in Diffusion Models

Shilin Lu, Zilan Wang, Leyang Li, Yanzhu Liu, Adams Wai-Kin Kong

Year: 2024Venue: arXiv preprintArea: Model EditingType: EmpiricalEmbeddings: 91

Models: Stable Diffusion

Intelligence

Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 95%

Last extracted: 3/12/2026, 8:10:22 PM

Summary

MACE (Mass Concept Erasure) is a finetuning framework for text-to-image diffusion models designed to erase multiple concepts (up to 100) simultaneously. It balances generality (erasing synonyms) and specificity (preserving unrelated concepts) by combining closed-form cross-attention refinement with individual LoRA modules for each concept, integrated via a non-interfering fusion loss.

Entities (5)

MACE · framework · 100%LoRA · technique · 98%Cross-Attention · mechanism · 95%Stable Diffusion · diffusion-model · 95%Grounded-SAM · tool · 90%

Relation Signals (3)

MACE → utilizes → LoRA

confidence 98% · it employs a unique LoRA module for each individual concept to remove its intrinsic information.

MACE → erases → Concepts

confidence 95% · MACE, a finetuning framework for the task of mass concept erasure.

MACE → refines → Cross-Attention

confidence 95% · MACE starts by refining the cross-attention layers of the pretrained model using a closed-form solution.

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:The rapid expansion of large-scale text-to-image diffusion models has raised growing concerns regarding their potential misuse in creating harmful or misleading content. In this paper, we introduce MACE, a finetuning framework for the task of mass concept erasure. This task aims to prevent models from generating images that embody unwanted concepts when prompted. Existing concept erasure methods are typically restricted to handling fewer than five concepts simultaneously and struggle to find a balance between erasing concept synonyms (generality) and maintaining unrelated concepts (specificity). In contrast, MACE differs by successfully scaling the erasure scope up to 100 concepts and by achieving an effective balance between generality and specificity. This is achieved by leveraging closed-form cross-attention refinement along with LoRA finetuning, collectively eliminating the information of undesirable concepts. Furthermore, MACE integrates multiple LoRAs without mutual interference. We conduct extensive evaluations of MACE against prior methods across four different tasks: object erasure, celebrity erasure, explicit content erasure, and artistic style erasure. Our results reveal that MACE surpasses prior methods in all evaluated tasks. Code is available at this https URL.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

90,464 characters extracted from source content.

Expand or collapse full text

MACE: Mass Concept Erasure in Diffusion Models Shilin Lu 1 Zilan Wang 1 Leyang Li 1 Yanzhu Liu 2 Adams Wai-Kin Kong 1 1 School of Computer Science and Engineering, Nanyang Technological University, Singapore 2 Institute for Infocomm Research (I 2 R) & Centre for Frontier AI Research (CFAR), A*STAR, Singapore shilin002, wang1982, lile0005@e.ntu.edu.sg, liu yanzhu@i2r.a-star.edu.sg, adamskong@ntu.edu.sg ‘a photo of the airplane’ (erased)‘a photo of Paul Walker’ (erased) ‘a photo of the aircraft’ (synonymous)‘a photo of Paul Wesley’ (unrelated) SD v1.4 MACE SD v1.4 MACE GeneralitySpecificity EfficacyEfficacy (a) Object Erasure(b) Celebrity Erasure(c) Scaling Erasure up to 100 Concepts Better Figure 1. Our proposed method, MACE, can erase a large number of concepts from text-to-image diffusion models. This can safeguard celebrity portrait rights, respect copyrights on artworks, and prevent explicit content creation. (a) MACE demonstrates good efficacy and generality by preventing the generation of images reflecting the target concept and its synonyms. (b) MACE maintains excellent specificity, ensuring that the unintended concepts remain intact, even when they share common terms with the target concept. (c) MACE exhibits a significantly enhanced ability to erase 100 concepts, outperforming previous methods. The overall score indicates the comprehensive erasing capability, as detailed in Section 4.3. Abstract The rapid expansion of large-scale text-to-image diffu- sion models has raised growing concerns regarding their potential misuse in creating harmful or misleading content. In this paper, we introduce MACE, a finetuning framework for the task of MAss Concept Erasure. This task aims to pre- vent models from generating images that embody unwanted concepts when prompted. Existing concept erasure meth- ods are typically restricted to handling fewer than five con- cepts simultaneously and struggle to find a balance between erasing concept synonyms (generality) and maintaining un- related concepts (specificity). In contrast, MACE differs by successfully scaling the erasure scope up to 100 concepts and by achieving an effective balance between generality and specificity. This is achieved by leveraging closed-form cross-attention refinement along with LoRA finetuning, col- lectively eliminating the information of undesirable con- cepts. Furthermore, MACE integrates multiple LoRAs with- out mutual interference. We conduct extensive evaluations of MACE against prior methods across four different tasks: object erasure, celebrity erasure, explicit content erasure, and artistic style erasure. Our results reveal that MACE sur- passes prior methods in all evaluated tasks. Code is avail- able at https://github.com/Shilin-LU/MACE. 1. Introduction In large-scale text-to-image (T2I) models [9, 14, 34, 40, 49, 54, 57, 73, 74, 76, 77], the task of concept erasure aims to remove concepts that may be harmful, copyrighted, or offensive. This ensures that when a model is prompted with any phrase related to deleted concepts, it will not generate images reflecting those concepts. The drive behind concept erasure is rooted in the sig- nificant risks posed by T2I models. These models can gen- erate inappropriate content, such as copyrighted artworks [23, 24, 55, 61], explicit content [22, 59, 72], and deepfakes [38, 70]. These issues are largely caused by the unfiltered, web-scraped training data [60]. While researchers have put efforts to mitigate these risks through refining datasets and retraining models, these methods are not only costly but also can lead to unforeseen outcomes [7, 44]. For example, despite being trained on a sanitized dataset, Stable Diffu- sion (SD) v2.0 [52] still produces explicit content. More- over, it exhibits a diminished generative quality for regular content when compared to its earlier versions [44]. Alterna- tive methods, such as post-generation filtering [41, 50] and inference guiding [3, 59], are effective when models are ac- cessed only via APIs. Yet, these safeguards can be easily 1 arXiv:2403.06135v1 [cs.CV] 10 Mar 2024 bypassed if users have access to the source code [63]. To mitigate the vulnerability of these safeguards, sev- eral finetuning-based methods have been proposed [16, 17, 19, 25, 30, 71]. Nonetheless, the challenge of concept era- sure lies in balancing the dual requirements of generality and specificity. Generality requires that a concept should be consistently removed, regardless of its expression and the context in which it appears. On the other hand, specificity requires that unrelated concepts remain intact. Our analy- sis reveals that there is substantial room for enhancing these methods with respect to both generality and specificity. We pinpoint three primary issues that hinder the effec- tiveness of prior works. Firstly, the information of a phrase is concealed within other words in the prompt through the attention mechanism [69]. This is sufficient to evoke the concept from T2I models (see Figure 2), leading to re- stricted generality and incomplete elimination when remov- ing concepts. Secondly, finetuning the diffusion model’s prediction on early denoising steps (t > t 0 ) can result in degraded specificity of concept erasure. Typically, diffu- sion models generate a general context in the early stage [12, 31, 51]. For instance, when generating a portrait of Paul Walker or Paul Wesley, the initial sampling trajectory gravitates towards the face manifold. It begins by form- ing a vague outline that could resemble any person. Af- ter a turning point, a.k.a. spontaneous symmetry breaking (SSB) [51], the identity becomes clear with the details pro- gressively filled in. If our goal is to only prevent the model from generating images of Paul Walker, it should not impact other celebrities named ‘Paul’ (See Figure 1). However, if we alter the predictions made in the early stages, other ‘Pauls’ can inadvertently be affected. Lastly, when fineturn- ing methods are applied to erase a large number of concept (e.g., 100), a noticeable decline in performance is observed. This decline is due to either sequential or parallel finetun- ing of the models. The former is prone to catastrophic for- getting and the latter results in interference among different concepts being finetuned. In light of these challenges, we propose a framework, dubbed MAss Concept Erasure (MACE), to erase a large number of concepts from T2I diffusion models. MACE not only achieves a superior balance between generality and specificity, but also adeptly handles the erasure of 100 con- cepts. It requires neither concept synonyms nor the original training data to perform concept erasure. To remove multi- ple concepts, MACE starts by refining the cross-attention layers of the pretrained model using a closed-form solu- tion. This design encourages the model to refrain from em- bedding residual information of the target phrase into other words, thereby erasing traces of the concept in the prompt. Secondly, it employs a unique LoRA module [21] for each individual concept to remove its intrinsic information. To maintain specificity, MACE exploits concept-focal impor- Generated Image “puppyonthegrass” (a) Normal generation. (b) Replacing the text embedding of ‘puppy’ with that of the final [EOS] token. Figure 2.A concept can be generated solely via residual infor- mation:(a) Average cross-attention map for each word presents that a concept’s information is embedded within other words. (b) A puppy can be generated solely using residual information by re- placing the text embedding of ‘puppy’ with that of the final[EOS] token. Additional examples are available in Figure 10. tance sampling during LoRA training, mitigating the impact on unintended concepts. Finally, we develop a loss function for MACE to harmoniously integrate multiple LoRA mod- ules without interfering with one another, while prevent- ing catastrophic forgetting. This integration loss can also be swiftly solved using a closed-form solution. We conduct extensive evaluations on four distinct tasks, including object erasure, celebrity erasure, explicit content erasure, and artis- tic style erasure. MACE demonstrates superior performance on mass concept erasure and strikes an effective balance between specificity and generality, compared with state-of- the-art (SOTA) methods. This achievement paves the way for safer and more regulated T2I applications. 2. Preliminaries and Related Work We provide an overview of two foundational preliminaries upon which our work is based in Appendix A. The first pre- liminary is the latent diffusion model, which serves as the cornerstone for the T2I model that we investigate. The sec- ond one is the cross-attention mechanism, a common fea- ture in T2I models. Concept erasure.Existing research on preventing un- wanted outputs from T2I models can be broadly grouped into four categories: post-image filtering [41, 50], infer- ence guidance [3, 59], retraining with the curated dataset [40, 52], and model finetuning [16, 17, 19, 25, 30, 39, 71]. The first two methods are post-hoc solutions and do not ad- dress the inherent propensity of the models to generate in- appropriate content [63]. Although retraining with curated datasets may offer a solution, it demands significant compu- tational effort and time (e.g., over 150,000 A100 GPU hours for retraining Stable Diffusion) [53]. Finetuning pretrained T2I models is a more viable approach. However, most meth- ods either overlook the residual information of the target phrase embedded within co-existing words, focusing solely 2 on the target phrase [16, 17, 71], or they finetune uniformly across timesteps [16, 25, 30, 71]. Modifications to diffusion models conditioned on timesteps before SSB [51] can nega- tively affect the generation of retained concepts. In contrast, the proposed MACE addresses these challenges effectively. Image cloaking.An alternative method for safeguarding images against imitation or memorization [8, 65] by T2I models involves an additional step of applying adversar- ial perturbations to photographs or artworks before they are posted online. This technique, often referred to as cloaking, enables individuals to effectively conceal their images from models during the training phase but remain accessible and discernible to human viewers [58, 62, 75]. Nevertheless, it is crucial to note that this strategy is applicable only to con- tent not yet posted online. To safeguard the vast amount of content already on the web, concept erasure can serve as a viable strategy for large model providers as they prepare to release more advanced models in subsequent evolutions. 3. Method We aim to develop a framework to erase a large number of concepts from pretrained T2I diffusion models. This frame- work takes two inputs: a pretrained model and a set of target phrases that expresses the concepts to be removed. It returns a finetuned model that is incapable of generating images de- picting the concepts targeted for erasing. An effective era- sure framework should fulfill the following criteria: •Efficacy (block target phrases):If the finetuned model is conditioned on prompts with those target phrases, its outputs should have limited semantic alignment with the prompts. Yet, the outputs should still appear natural, ei- ther aligning with a generic category (e.g., sky), or de- faulting to the super-category of the concept, if one exists. •Generality (block synonyms):The model should also prevent the generation of images semantically related to any synonyms of the targeted phrases, ensuring that the erasure is not limited to the exact wording of the prompts. •Specificity (preserve unrelated concepts):If the fine- tuned model is conditioned on prompts that are semanti- cally unrelated to the erased concepts, its output distribu- tion should closely align with that of the original model. To this end, we introduce MACE, a MAss Concept Era- sure framework. The information of a phrase is embedded not only within the phrase itself but also within the words it co-exists with. To effectively erase the targeted concepts, our framework first removes the residual information from the co-existing words (Section 3.1). Subsequently, distinct LoRA modules are trained to eliminate the intrinsic infor- mation specific to each target concept (Section 3.2). Lastly, our framework integrates multiple LoRA modules without mutual interference, leading to a final model that effectively Res Block SA Block CA Block Single LoRA Loss CA Block CA Block ‘a photo of a puppy’ Multi- LoRA (a) Internal Structure of One U-Net Block(b) Closed-Form Refinement (c) LoRA Finetuning Concept 1Concept 2Concept 3Fusion (d) Multi-LoRA Fusion Loss InputOutputGround Truth Figure 3.Overview of MACE:(a) Our framework focuses on tun- ing the prompts-related projection matrices,W k andW v , within cross-attention (CA) blocks. (b) (Section 3.1 & Figure 4) The pre- trained U-Net’s CA blocks are refined using a closed-form so- lution, discouraging the model from embedding the residual in- formation of the target phrase into surrounding words. (c) (Sec- tion 3.2 & Figure 5) For each concept targeted for removal, a distinct LoRA module is learned to eliminate its intrinsic infor- mation. (d) (Section 3.3) A closed-form solution is introduced to integrate multiple LoRA modules without interfering with one an- other while averting catastrophic forgetting. forgets a wide array of concepts (Section 3.3). Figure 3 presents an overview of our framework. 3.1. Closed-Form Cross-Attention Refinement In this section, we suggest a closed-form cross-attention re- finement to encourage the model to refrain from embed- ding residual information of the target phrase into other words. Such residual information is adequate to evoke the unwanted concept from T2I models. The root of this issue lies in the attention mechanism [69], where the text embed- ding of a token encapsulates information from other tokens. This results in its ‘Key’ and ‘Value’ vectors absorbing and reflecting information from other tokens. To tackle this, we focus on refining the cross-attention modules, which play a pivotal role in processing text prompts. For example, when altering the projection matrix W k , we modify it such that the ‘Keys’ of the words that co- exist with the target phrase in the prompt are mapped to the ‘Keys’ of those same words in another prompt, where the target phrase is replaced with either its super-category or a generic concept. Notably, the ‘Keys’ of the target phrase itself remain unchanged to avoid impacting on other unin- tended concepts associated with that phrase. Figure 4 illus- trates this process using the projection matrixW k , and the same principle is applicable toW v . Drawing upon methods that view matrices as linear as- sociative memories [1, 28], often used to edit knowledge 3 ‘photo of sky’ ‘photo of airplane’ airplane Text Encoder of photo Text Embeddings Keys Loss sky of photo airplane of photo sky of photo Prompt Augmentation airplane ‘image of ’ ‘photo of ’ ‘ in a photo’ · · sky Target Concept Mapping Concept Figure 4.Closed-Form Cross-Attention Refinement:TheW ′ k is tuned such that the ‘Keys’ of words co-existing with the target phrase ‘airplane’ are mapped to the ‘Keys’ of those same words when the target phrase is replaced with a generic concept ‘sky’. embedded within neural networks [2, 4, 5, 17, 36, 37, 43], we formulate our objective function as follows: min W ′ k n X i=1 W ′ k ·e f i −W k ·e g i 2 2 +λ 1 n+m X i=n+1 ∥W ′ k ·e p i −W k ·e p i ∥ 2 2 , (1) whereλ 1 ∈R + is a hyperparameter,e f i is the embedding of a word co-existing with the target phrase,e g i is the em- bedding of that word when the target phrase is replaced with its super-category or a generic one,e p i is the embedding for preserving the prior,W k is the pretrained weights, andn,m are the number of embeddings for mapping and preserving, respectively. As derived in Appendix B, this optimization problem has a closed-form solution: W ′ k = n X i=1 W k ·e g i ·(e f i ) T +λ 1 n+m X i=n+1 W k ·e p i ·(e p i ) T ! · n X i=1 e f i ·(e f i ) T +λ 1 n+m X i=n+1 e p i ·(e p i ) T ! −1 ,(2) where P n+m i=n+1 W k e p i (e p i ) T and P n+m i=n+1 e p i (e p i ) T are pre- cached constants for preserving prior. These constants are capable of encapsulating both general and domain-specific knowledge, as detailed in Appendix B. The general knowl- edge is estimated on the MS-COCO dataset [32] by default. 3.2. Target Concept Erasure with LoRA After applying the closed-form refinement to eliminate the traces of the target concepts from co-existing words (Sec- tion 3.1), our focus shifts to erasing the intrinsic information within the target phrase itself. Loss function.Intuitively, if a concept is to appear in gener- ated images, it should exert significant influence on several patches of those images [10, 46]. This implies that the atten- tion maps corresponding to the tokens of the concept should Pretrained U-Net Closed-Form Refined U-Net LoRA Layers ‘photo of airplane’ t ‘photo of airplane’ LoRA Gradient Activation Loss Grounded SAM Closed-Form Refined U-Net ‘photo of airplane’ LoRA Gradient Activation Loss Grounded SAM Closed-Form Refined U-Net ‘photo of airplane’ LoRA Gradient Gradient Grounded-SAM : Minimize Activation Figure 5.Training with LoRA to Erase Intrinsic Information: Eight images are generated for each target concept as a training set via SD v1.4. To obtain the attention maps, the images undergo forward diffusion to timesteptand then are fed into the closed- form refined model for predicting noise at timestept. The LoRA modules are trained to reduce the activation in the masked atten- tion maps that correspond to the target phrase. display high activation values in certain regions. We adapt this principle in an inverse manner to eliminate the infor- mation within the target phrase itself. The loss function is designed to suppress the activation in certain regions of the attention maps that correspond to the target phrase tokens. These specific regions are identified by segmenting the in- put image with Grounded-SAM [27, 33]. Figure 5 depicts the training process. The loss function is defined as: min X i∈S X l A i t,l ⊙M 2 F ,(3) whereSis the set of indices corresponding to the tokens of the target phrase,A i t,l is the attention map of tokeniat layer land timestept,Mis the segmentation mask, and∥·∥ F is the Frobenius norm. Parameter subset to finetune.To minimize the loss func- tion (Eq. (3)), we tune the closed-form refined projection matrices,W ′ k andW ′ v , by identifying a set of weight mod- ulations,∆W k and∆W v . Determining high-dimensional modulation matrices in large-scale models is non-trivial. However, weight modulations usually have a low intrinsic rank when they are adapted for specific downstream tasks [21]. Hence, we decompose the modulation matrices us- ing LoRA [21]. Specifically, for each target concept and each projection matrix (e.g.,W ′ k ∈R d in ×d out ), we learn two matrices,B∈R d in ×r andD∈R r×d out , wherer≪ min(d in ,d out )is the decomposition rank. The new modu- lated matrices are: ˆ W k =W ′ k + ∆W k =W ′ k +B×D.(4) Concept-focal importance sampling (CFIS).If the atten- tion loss (Eq. (3)) is computed based on attention maps that 4 are obtained at uniformly sampled timesteps, the predicted score function at various noise levels will be affected. Con- sequently, it will influence the entire sampling trajectory, undermining the specificity of concept erasure. This issue is especially problematic when erasing phrases that contain polysemous words or common surnames and given names. The reason lies in the nature of the diffusion trajectory. The sample initially gravitates towards the data manifold and possesses the potential to converge to various concept modes associated with the conditional phrase [11, 51]. Af- ter the turning point (a.k.a., SSB [51]), the specific mode to be fully denoised is determined [51]. Our goal is to in- fluence only the path leading to a particular mode, such as ‘Bill Clinton’, rather than affecting paths leading to every celebrity named ‘Clinton’ or ‘Bill’. Thus, it is crucial that the early sampling trajectory remains largely unaffected. To this end, we opt not to sample the timesteptfrom a uniform distribution when training LoRA. Instead, we intro- duce a sampling distribution that assigns greater probability to smaller values oft. The probability density function for samplingtis defined as (A graph of this function is pro- vided in Appendix E): ξ(t) = 1 Z (σ(γ(t−t 1 ))−σ(γ(t−t 2 ))),(5) whereZis a normalizer,σ(x)is the sigmoid function 1/(1 +e −x ), witht 1 andt 2 as the bounds of a high prob- ability sampling interval(t 1 < t 2 ), andγas a temperature hyperparameter. We empirically sett 1 = 200,t 2 = 400, andγ= 0.05throughout our experiments. This strategy excels particularly in eliminating mass con- cepts that share overlapping terms. However, it is impor- tant to note that when erasing a smaller number of con- cepts or mass concepts that do not share overlapping terms, the improvements tend to be incremental. Beyond enhanc- ing specificity, this design significantly boosts training ef- fectiveness by fostering a more concentrated and efficient learning process. 3.3. Fusion of Multi-LoRA Modules In this section, we present a scheme to fuse multiple LoRA modules. Each LoRA module acts as a conceptual suppres- sor for the pretrained model, inducing a state of amnesia wherein the model loses their grasp on a specific concept. When working collaboratively, these modules should col- lectively enable the model to forget all the concepts targeted for erasure. A na ̈ ıve solution for integrating LoRA modules is to utilize a weighted sum [56]: ˆ W k =W ′ k + q X i=1 ω i ∆W k,i ,s.t. q X i=1 ω i = 1,(6) whereW ′ k is the closed-form refined weight,∆W k,i is the LoRA module associated with theith concept,ω i is the nor- malized weighting factor, andqis the number of the target concepts. This na ̈ ıve fusion method leads to interference among the modules, thereby diminishing the erasure per- formance, as evidenced in the ablation study (Section 4.6). To preserve the capability of LoRA modules, we intro- duce a novel fusion technique illustrated in Figure 3 (d). We input the text embeddings of the target phrases into the re- spective LoRA module. The resulting outputs serve as the ground truth for optimizing the projection matrices. The ob- jective function is defined by: min W ∗ k q X i=1 p X j=1 W ∗ k ·e f j −(W ′ k + ∆W k,i )·e f j 2 2 +λ 2 p+m X j=p+1 W ∗ k ·e p j −W k ·e p j 2 2 , (7) whereW k is the original weight,W ′ k is the closed-form refined weight,e f i is the embedding of a word co-existing with the target phrase,e p j is the embedding for prior pre- serving,λ 2 ∈R + is a hyperparameter,qis the number of erased concepts, andp,mare the number of embeddings for mapping and preserving. Similar to Eq. (2), this optimiza- tion problem has a closed-form solution as well. Compared with sequential or parallel finetuning of a pre- trained model for erasing multiple concepts, employing sep- arate LoRA modules for each concept and then integrating them offers better prevention against catastrophic forgetting and provides more flexibility. 4. Experiments In this section, we conduct a comprehensive evaluation of our proposed method, benchmarking it against SOTA baselines across four tasks. The baselines comprise ESD- u [16], ESD-x [16], FMN [71], SLD-M [59], UCE [17], and AC [30]. The four tasks are: object erasure (Sec- tion 4.2), celebrity erasure (Section 4.3), explicit content erasure (Section 4.4), and artistic style erasure (Section 4.5). All results from the original SD v1.4 and SD v2.1 are ob- tained without the application of negative prompts. Our evaluation not only measures efficacy but also ex- plores the generality and specificity of the erasure methods. The generality assessment is primarily conducted in the ob- ject erasure, since synonyms for a particular object tend to be precise and universally acknowledged compared to those for celebrities and artists. Evaluating specificity is more straightforward and is therefore applied across all tasks. We also focus on the effectiveness of these methods in handling multi-concept erasure, using the celebrity erasure as a key benchmark. We then highlight the superior performance of our proposed method in erasing explicit content and artistic styles. Lastly, we conduct ablation studies (Section 4.6) to understand the impact of the key components. 5 Table 1.Evaluation of Erasing the CIFAR-10 Classes:Results for the first four individual classes, along with the average results across 10 classes, are presented. CLIP classification accuracies are reported for each erased class in three sets: the erased class itself (Acc e , efficacy), the nine remaining unaffected classes (Acc s , specificity), and three synonyms of the erased class (Acc g , generality). The harmonic means H o reflect the comprehensive erasure capability. All presented values are denoted in percentage (%). Results pertaining to the latter six classes are available in Appendix D. The classification accuracies of images generated by the original SD v1.4 are presented for reference. Method Airplane ErasedAutomobile ErasedBird ErasedCat ErasedAverage across 10 Classes Acc e ↓Acc s ↑Acc g ↓H o ↑Acc e ↓Acc s ↑Acc g ↓H o ↑Acc e ↓Acc s ↑Acc g ↓H o ↑Acc e ↓Acc s ↑Acc g ↓H o ↑Acc e ↓Acc s ↑Acc g ↓H o ↑ FMN [71]96.7698.3294.156.1395.0896.8679.4511.4499.4698.1396.751.3894.8997.9795.716.8396.9696.7382.566.13 AC [30]96.2498.5593.35 6.1194.4198.4773.9213.1999.5598.5394.571.2498.9498.6399.101.4598.3498.5683.383.63 UCE [17]40.3298.7949.8364.094.7399.0237.2582.1210.7198.3515.9790.182.3598.022.5897.7013.5498.4523.1885.48 SLD-M [59]91.3798.8689.2613.6984.8998.8666.1528.3480.7298.3985.0023.3188.5698.4392.1713.3184.1498.5467.3526.32 ESD-x [16]33.1197.1532.2874.9859.6898.3958.8350.6218.5797.2440.5576.1712.5197.5221.9186.9826.9397.3231.6176.91 ESD-u [16]7.3885.485.9290.5730.2991.0232.1274.8813.1786.1720.6583.9811.7791.4513.5088.6818.2786.7616.2683.69 Ours9.0695.3910.0392.036.9795.1814.2291.159.8897.4515.4890.392.2298.853.9197.568.4997.3510.5392.61 SD v1.4 [54]96.0698.9295.08-95.7598.9575.91-99.7298.5195.45-98.9398.6099.05-98.6398.6383.64- 4.1. Implementation Details We finetune all models on SD v1.4 and generate images with DDIM sampler [66] over 50 steps. We follow [30] to augment the input target concept using prompts generated by the GPT-4 [42]. The prompt augmentation varies de- pending on the target concept type (e.g., objects or styles). Each LoRA module is trained for 50 gradient update steps. We implement baselines as per the configurations recom- mended in their original settings. Further details are pro- vided in Appendix C. 4.2. Object Erasure Evaluation setup.For each erasure method, we finetune ten models, with each model designed to erase one object class of the CIFAR-10 dataset [29]. To assess erasure effi- cacy, we use each finetuned model to generate 200 images of the intended erased object class, prompted by‘a photo of theerased class name’. These images are classified us- ing CLIP [47], and the criterion for successful erasure is a low classification accuracy. To assess specificity, we use each finetuned model to generate 200 images for each of the nine remaining, unmodified object classes with prompts ‘a photo of theunaltered class name’. A high classifi- cation accuracy indicates excellent erasure specificity. For assessing generality, we prepare three synonyms for each object class, listed in Table 6. Each finetuned model is used to generate 200 images for each synonym associated with the erased class, using the prompt‘a photo of thesynonym of erased class name’. In this case, good generality is re- flected by lower classification accuracies. Importantly, to evaluate the overall erasure capability of methods, we use the harmonic mean of efficacy, specificity, and generality. It is calculated as follows: H o = 3 (1−Acc e ) −1 + (Acc s ) −1 + (1−Acc g ) −1 ,(8) whereH o is the harmonic mean for object erasure, Acc e is the accuracy for the erased object (efficacy), Acc s for the remaining objects (specificity), and Acc g for the synonyms of the erased object (generality). A lower value of Acc e and Acc g , and a higher Acc s contribute to a higher harmonic mean, indicating a superior comprehensive erasure ability. Discussions and analysis.Table 1 presents the results of erasing the first four object classes of the CIFAR-10 dataset, as well as the average results across all 10 classes. The re- sults of the latter six classes can be found in Appendix D. Our approach attains the highest harmonic mean across the erasure of nine object classes, with the exception of ‘cat’, where our performance nearly matches the top result. This underscores the superior erasure capabilities of our ap- proach, striking an effective balance between specificity and generality. Additionally, it is noteworthy that while meth- ods like FMN [71] and AC [30] are proficient in removing specific features of a subject, they fall short in completely eradicating the subject’s generation. 4.3. Celebrity Erasure Evaluation setup.In this section, we evaluate the erasure methods with respect to their ability to erase multiple con- cepts. We establish a dataset consisting of 200 celebri- ties whose portraits, generated by SD v1.4, are recogniz- able with remarkable accuracy(>99%)by the GIPHY Celebrity Detector (GCD) [18]. The dataset is divided into two groups: an erasure group with 100 celebrities whom users aim to erase, and a retention group with 100 other celebrities whom users intend to preserve. The complete list of these celebrities is provided in Table 7. We perform a series of four experiments where SD v1.4 is finetuned to erase 1, 5, 10, and all 100 celebrities in the erasure group. The efficacy of each erasure method is tested by generating images of the celebrities intended for erasure. Successful erasure is measured by a low top-1 GCD accu- racy in correctly identifying the erased celebrities. To test the specificity of methods on the retained celebrities, we generate and evaluate images of the celebrities in the reten- tion group in the same way. A high specificity is indicated by a high top-1 GCD accuracy. 6 SD v1.4UCESLD-MESD-xESD-uOurs Specificity: ‘A sketch of Bill Murray’ Efficacy: ‘Bill Clinton in an official photo’ Specificity: ‘A portrait of Amanda Seyfried’ Figure 6.Qualitative Comparison of Erasing 100 Celebrities from SD v1.4:Bill Clinton belongs to the erasure group for assessing efficacy, while Bill Murray and Amanda Seyfried are in the retention group to evaluate specificity. Preserving Bill Murray’s images is challenging, as his first name is the same as Bill Clinton’s, who is in the erasure group. Additional examples are in Appendix F. Similar to Eq. (8), we underscore the comprehensive ability of the multi-concept erasure method by computing the harmonic mean of efficacy and specificity: H c = 2 (1−Acc e ) −1 + (Acc s ) −1 ,(9) whereH c is the harmonic mean for celebrity erasure, Acc e is the accuracy for the erased celebrities (efficacy), and Acc s for the retained celebrities (specificity). Furthermore, we as- sess the specificity of methods on regular content utiliz- ing the MS-COCO dataset [32]. We sample 30,000 cap- tions from the validation set to generate images and evaluate FID [45] and CLIP score [47]. Discussions and analysis.Figure 7 (c) illustrates a notable enhancement in overall erasure performance achieved by our method, particularly when 100 concepts are erased. This improvement indicates a more effective balance between ef- ficacy and specificity. FMN [71], AC [30], and SLD-M [59] demonstrate limited effectiveness in erasing multiple con- cepts, which inadvertently results in their high specificity. UCE [17] proves more effective, but its specificity decreases rapidly when more than 10 concepts are erased. Further- more, it fails to maintain FID and CLIP score within a rea- sonable range when erasing more than 10 celebrities while preserving only 100. As to ESD-u [16] and ESD-x [16], while effective, result in a lower proportion of facial images in their outputs (i.e., limited conceptual integrity), as shown in Figure 7 (f). This suggests that when their refined mod- els are conditioned on erased celebrities, their outputs de- viate from human likenesses, often leading to unpredictable (a) Efficacy(b) Specificity(c) Overall (d) Image Quality(e) Semantic Alignment(f) Conceptual Integrity Figure 7.Evaluation of Erasing Multiple Celebrity:The evalu- ation metrics include the detection accuracy on images of erased celebrities (Acc e ↓) and those of retained celebrities (Acc s ↑), the harmonic mean (H c ↑) which indicates overall erasure per- formance, FID, CLIP score, and the ratio of facial images. and uncontrollable outcomes. This phenomenon is shown in Figure 6, which presents a qualitative comparison of eras- ing 100 celebrities. In this comparison, Bill Clinton is in the erasure group, whereas Bill Murray and Amanda Seyfried are in the retention group. Notably, the preservation of Bill Murray’s image poses a challenge due to his shared first 7 Table 2.Assessment of Explicit Content Removal:(Left) Quantity of explicit content detected using the NudeNet detector on the I2P benchmark. (Right) Comparison of FID and CLIP on MS-COCO. The performance of the original SD v1.4 is presented for reference. SD v2.1 serves as a baseline that retrains the model from scratch on the curated dataset. † : Results sourced from [19]. F: Female. M: Male. Method Results of NudeNet Detection on I2P (Detected Quantity)MS-COCO 30K ArmpitsBellyButtocksFeetBreasts (F)Genitalia (F)Breasts (M)Genitalia (M)Total↓FID↓CLIP↑ FMN [71]4311712591551719242413.5230.39 AC [30]15318045662982267783814.1331.37 UCE [17]296272935511418214.0730.85 SLD-M [59]477232139126321216.3430.90 ESD-x [16]59731239100618831514.4130.69 ESD-u [16]32302192738212315.1030.21 SA † [19]72771925831600292-- Ours17192391629711113.4229.41 SD v1.4 [54]14817029632661842774314.0431.34 SD v2.1 [52]1051591760177957258614.8731.53 name, ‘Bill,’ with Bill Clinton in the erasure group. Our method effectively overcomes this issue. 4.4. Explicit Content Erasure Evaluation setup.In this section, we attempt to mitigate the generation of explicit content in T2I models. We adopt the same setting used in SA [19], finetuning SD v1.4 to erase four target phrases: ‘nudity’, ‘naked’, ‘erotic’, and ‘sexual’. To evaluate efficacy and generality, we use each finetuned model to generate images using all 4,703 prompts sourced from the Inappropriate Image Prompt (I2P) dataset [59]. The NudeNet [6] is employed to identify explicit content in these images, using a detection threshold of 0.6. Addi- tionally, to assess specificity on regular content, we evalu- ate FID and CLIP score on the MS-COCO validation set, similar to the process described in Section 4.3. Discussions and analysis.Table 2 presents our findings. Our refined model successfully generates the least amount of explicit content when conditioned on 4,703 prompts. Moreover, it showcases an impressive performance in FID, even surpassing the original SD v1.4. We note that such finetuning often does not have a consistent trend in improv- ing or worsening FID and CLIP score on regular content generation. This pattern is also observed in the celebrity erasure, as shown in Figure 7 (d) and (e). Therefore, we consider the performance acceptable as long as FID and CLIP score remain within a reasonable range. It is also note- worthy that retraining SD v2.1 from scratch using a dataset curated to exclude explicit content yields only a minor im- provement, compared with the original SD v1.4. Qualitative comparisons are provided in Appendix F for reference. 4.5. Artistic Style Erasure In this section, we evaluate our method and the baselines on erasing multiple artistic styles from SD v1.4. We utilize the Table 3.Assessment of Erasing 100 Artistic Styles:H a indicates overall erasure performance. MethodCLIP e ↓CLIP s ↑H a ↑FID-30K↓CLIP-30K↑ FMN [71]29.6328.90-0.7313.9931.31 AC [30]29.2628.54-0.7214.0831.29 UCE [17]21.3125.704.3977.7219.17 SLD-M [59]28.4927.89-0.617.9530.87 ESD-x [16]20.8921.210.3215.1929.52 ESD-u [16]19.6619.55-0.1117.0727.76 Ours22.5928.58 5.9912.7129.51 SD v1.429.6328.90-14.0431.34 Image Synthesis Style Studies Database [23], which com- piles a list of artists whose styles can be replicated by SD v1.4. From this database, we sample 200 artists and split them into two groups: an erasure group of 100 artists and a retention group with 100 other artists. The complete list is provided in Table 9. To assess efficacy and specificity, we apply prompts like‘Image in the style ofartist name’to both the erased and retained artists. We evaluate the erasure methods using two metrics: CLIP e and CLIP s . The CLIP e , which tests efficacy, is calculated between the prompts of the erased artists and the generated images. A lower CLIP e indicates better efficacy. Similarly, the CLIP s , which as- sesses specificity, is calculated between the prompts of the retained artists and the generated images. A higher CLIP s signifies better specificity. We calculate the overall erasing capability byH a =CLIP s −CLIP e . As reported in Table 3, our method also shows the superior ability to erase artistic styles on a large scale. 4.6. Ablation Study To study the impact of our key components, we conduct ab- lation studies on the challenging task of erasing 100 celebri- ties from SD v1.4. Different variations and their results are presented in Table 4. Variation 1 struggles to balance ef- ficacy and specificity. When prioritizing prior preservation, 8 Table 4.Ablation Study on the Impact of Key Components in Erasing 100 Celebrities.CFR: closed-form refinement. NLF: na ̈ ıve LoRA fusion. CFLF: closed-form LoRA fusion. CFIS: concept-focal importance sampling. All presented values are de- noted in percentage (%). Config ComponentsMetrics CFRLoRANLFCFLFCFISAcc e ↓Acc s ↑H c ↑ 1✓× × × ×67.7985.0546.72 2✓× ×0.0832.1648.66 3✓×✓×18.7061.78 70.21 Ours✓×✓4.3184.5689.78 SD v1.4-----96.4893.886.79 Table 5.Ablation Study on the Impact of LoRA Finetuned Pro- jection Matrices in Erasing 100 Celebrities.All presented val- ues are denoted in percentage (%). ConfigVariationTuning Step Metrics Acc e ↓Acc s ↑H c ↑ 5Tune Key Only50 steps12.7280.5483.77 6Tune Value Only 50 steps0.7738.6555.63 25 steps3.2862.7476.11 10 steps10.4777.8183.26 5 steps12.7280.4583.73 3 steps14.4681.70 83.58 1 steps15.3982.3783.48 OursTune Key & Value50 steps4.3184.5689.78 its ability to erase is compromised. Variation 2, which trains LoRA without CFIS, restricts its specificity. Moreover, the na ̈ ıve integration of LoRA exacerbates this issue, leading to poor specificity despite the successful erasure of the target concepts. Variation 3 fuses LoRA with closed-form fusion, which prevents interference from different LoRA modules, thereby improving specificity. However, without the CFIS, this configuration shows reduced training efficiency in era- sure and decreased specificity. We also carry out ablation studies focused on indepen- dently adjusting either the ‘Key’ or ‘Value’ projection ma- trices, as detailed in Table 5. Intriguingly, exclusively fine- tuning the‘Value’ projection matrices for an identical num- ber of steps can result in the deterioration of unrelated con- cepts, as indicated by a lower Acc s . While fine-tuning only the ‘Value’ projection matrices might seem efficient for ob- taining satisfactory outcomes with minimal adjustments, its peak performance is notably inferior. 5. Additional Applications MACE possesses the capability to simultaneously erase dif- ferent types of concepts, such as both a celebrity likeness and artistic style, as shown in Figure 8 (a). Furthermore, MACE is compatible with distilled fast diffusion models (e.g., Latent Consistency Model [35]), with an example pre- sented in Figure 8 (b). (b) MACE on LCM (4-step generation) (a) Erase different types of concepts simultaneously Figure 8.(a) MACE can simultaneously erase different types of concepts.The left image is generated from the original SD v1.4. The right one is generated by the MACE finetuned SD v1.4 which erases the concepts of a celebrity (Bill Clinton) and a artistic style (Brent Heighton). Both images are generated using the prompt ‘Bill Clinton walking, Brent Heighton style’.(b) MACE is com- patible with distilled diffusion models. The left image is gen- erated from the original LCM Dreamshaper v7. The right one is generated by the MACE finetuned LCM which erases the concept of ‘Trump’. Both images are generated using the prompt‘a photo of Trump playing guitar’. 6. Limitations and Conclusion Our proposed method, MACE, offers an effective solution for erasing mass concepts from T2I diffusion models. Our extensive experiments reveal that MACE achieves a remark- able balance between specificity and generality, particularly in erasing numerous concepts, surpassing the performance of prior methods. However, a discernible decline in the har- monic mean is observed as the number of erased concepts increases from 10 to 100. This trend could pose a limita- tion in erasing thousands of concepts from more advanced models in the future. Exploring ways to further scale up the erasure scope presents a crucial direction for future re- search. We believe MACE can be a pivotal tool for gen- erative model service providers, empowering them to effi- ciently eliminate a variety of unwanted concepts. This is a vital step in releasing the next wave of advanced models, contributing to the creation of a safer AI community. Acknowledgement This research is supported by the National Research Foundation, Singapore under its Strategic Capability Research Centres Funding Initiative. Any opinions, find- ings and conclusions or recommendations expressed in this material are those of the author(s) and do not re- flect the views of National Research Foundation, Singapore. References [1] James A Anderson. A simple neural network generating an interactive memory.Mathematical biosciences, 14(3-4): 197–220, 1972. 3 [2] Dana Arad, Hadas Orgad, and Yonatan Belinkov. Refact: Updating text-to-image models by editing the text encoder. arXiv preprint arXiv:2306.00738, 2023. 4 9 [3] AUTOMATIC1111.Negative prompt.https : / / github . com / AUTOMATIC1111 / stable - diffusion - webui / wiki / Negative - prompt. 1, 2 [4] Samyadeep Basu, Nanxuan Zhao, Vlad Morariu, Soheil Feizi, and Varun Manjunatha. Localizing and editing knowl- edge in text-to-image generative models.arXiv preprint arXiv:2310.13730, 2023. 4 [5] David Bau, Steven Liu, Tongzhou Wang, Jun-Yan Zhu, and Antonio Torralba. Rewriting a deep generative model. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part I 16, pages 351–369. Springer, 2020. 4 [6] P Bedapudi. Nudenet: Neural nets for nudity classification, detection and selective censoring, 2019. 8 [7] Nicholas Carlini, Matthew Jagielski, Chiyuan Zhang, Nico- las Papernot, Andreas Terzis, and Florian Tramer. The pri- vacy onion effect: Memorization is relative.Advances in Neural Information Processing Systems, 35:13263–13276, 2022. 1 [8] Nicolas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagiel- ski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ip- polito, and Eric Wallace. Extracting training data from diffu- sion models. In32nd USENIX Security Symposium (USENIX Security 23), pages 5253–5270, 2023. 3 [9] Huiwen Chang, Han Zhang, Jarred Barber, AJ Maschinot, Jose Lezama, Lu Jiang, Ming-Hsuan Yang, Kevin Mur- phy, William T Freeman, Michael Rubinstein, et al. Muse: Text-to-image generation via masked generative transform- ers.arXiv preprint arXiv:2301.00704, 2023. 1 [10] Hila Chefer, Yuval Alaluf, Yael Vinker, Lior Wolf, and Daniel Cohen-Or. Attend-and-excite: Attention-based se- mantic guidance for text-to-image diffusion models.ACM Transactions on Graphics (TOG), 42(4):1–10, 2023. 4 [11] Defang Chen, Zhenyu Zhou, Jian-Ping Mei, Chunhua Shen, Chun Chen, and Can Wang. A geometric perspective on dif- fusion models.arXiv preprint arXiv:2305.19947, 2023. 5 [12] Jooyoung Choi, Jungbeom Lee, Chaehun Shin, Sungwon Kim, Hyunwoo Kim, and Sungroh Yoon. Perception pri- oritized training of diffusion models.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 11472–11481, 2022. 2 [13] Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis.Advances in Neural Informa- tion Processing Systems, 34:8780–8794, 2021. 13 [14] Ming Ding, Wendi Zheng, Wenyi Hong, and Jie Tang. Cogview2: Faster and better text-to-image generation via hi- erarchical transformers.Advances in Neural Information Processing Systems, 35:16890–16902, 2022. 1 [15] Patrick Esser, Robin Rombach, and Bjorn Ommer. Taming transformers for high-resolution image synthesis. InPro- ceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 12873–12883, 2021. 13 [16] Rohit Gandikota, Joanna Materzynska, Jaden Fiotto- Kaufman, and David Bau. Erasing concepts from diffusion models.arXiv preprint arXiv:2303.07345, 2023. 2, 3, 5, 6, 7, 8, 15, 18 [17] Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzy ́ nska, and David Bau. Unified concept editing in dif- fusion models.arXiv preprint arXiv:2308.14761, 2023. 2, 3, 4, 5, 6, 7, 8, 14, 15, 18 [18] Nick Hasty, Ihor Kroosh, Dmitry Voitekh, and Dmytro Ko- rduban. Giphy celebrity detector.https://github. com/Giphy/celeb-detection-oss. 6, 15 [19] Alvin Heng and Harold Soh. Selective amnesia: A continual learning approach to forgetting in deep generative models. arXiv preprint arXiv:2305.10120, 2023. 2, 8, 15 [20] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffu- sion probabilistic models.Advances in Neural Information Processing Systems, 33:6840–6851, 2020. 13 [21] Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models.arXiv preprint arXiv:2106.09685, 2021. 2, 4 [22] Tatum Hunter. Ai porn is easy to make now. for women, that’s a nightmare. 2023. 1 [23] Surea I, Proxima Centauri B, Erratica, and Stephen Young.Image synthesis style studies.https:// w . aiartapps . com / ai - art - apps / image - synthesis-style-studies. 1, 8, 15, 17 [24] Harry H Jiang, Lauren Brown, Jessica Cheng, Mehtab Khan, Abhishek Gupta, Deja Workman, Alex Hanna, Johnathan Flowers, and Timnit Gebru. Ai art and its impact on artists. InProceedings of the 2023 AAAI/ACM Conference on AI, Ethics, and Society, pages 363–374, 2023. 1 [25] Sanghyun Kim, Seohyeon Jung, Balhae Kim, Moonseok Choi, Jinwoo Shin, and Juho Lee.Towards safe self- distillation of internet-scale text-to-image diffusion models. arXiv preprint arXiv:2307.05977, 2023. 2, 3 [26] Diederik Kingma, Tim Salimans, Ben Poole, and Jonathan Ho. Variational diffusion models.Advances in neural infor- mation processing systems, 34:21696–21707, 2021. 13 [27] Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloe Rolland, Laura Gustafson, Tete Xiao, Spencer White- head, Alexander C. Berg, Wan-Yen Lo, Piotr Doll ́ ar, and Ross Girshick. Segment anything.arXiv:2304.02643, 2023. 4 [28] Teuvo Kohonen.Associative memory: A system-theoretical approach. Springer Science & Business Media, 2012. 3 [29] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009. 6, 14, 17 [30] Nupur Kumari, Bingliang Zhang, Sheng-Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Yan Zhu. Ablating con- cepts in text-to-image diffusion models. InProceedings of the IEEE/CVF International Conference on Computer Vi- sion, pages 22691–22702, 2023. 2, 3, 5, 6, 7, 8, 15, 18 [31] Mingi Kwon, Jaeseok Jeong, and Youngjung Uh. Diffusion models already have a semantic latent space.arXiv preprint arXiv:2210.10960, 2022. 2 [32] Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll ́ ar, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pages 740–755. Springer, 2014. 4, 7, 14 10 [33] Shilong Liu, Zhaoyang Zeng, Tianhe Ren, Feng Li, Hao Zhang, Jie Yang, Chunyuan Li, Jianwei Yang, Hang Su, Jun Zhu, et al. Grounding dino: Marrying dino with grounded pre-training for open-set object detection.arXiv preprint arXiv:2303.05499, 2023. 4 [34] Shilin Lu, Yanzhu Liu, and Adams Wai-Kin Kong. Tf-icon: Diffusion-based training-free cross-domain image composi- tion. InProceedings of the IEEE/CVF International Confer- ence on Computer Vision, pages 2294–2305, 2023. 1 [35] Simian Luo, Yiqin Tan, Longbo Huang, Jian Li, and Hang Zhao.Latent consistency models: Synthesizing high- resolution images with few-step inference.arXiv preprint arXiv:2310.04378, 2023. 9 [36] Kevin Meng, David Bau, Alex Andonian, and Yonatan Be- linkov.Locating and editing factual associations in gpt. Advances in Neural Information Processing Systems, 35: 17359–17372, 2022. 4 [37] Kevin Meng, Arnab Sen Sharma, Alex Andonian, Yonatan Belinkov, and David Bau. Mass-editing memory in a trans- former.arXiv preprint arXiv:2210.07229, 2022. 4 [38] Yisroel Mirsky and Wenke Lee. The creation and detection of deepfakes: A survey.ACM Computing Surveys (CSUR), 54(1):1–41, 2021. 1 [39] Zixuan Ni, Longhui Wei, Jiacheng Li, Siliang Tang, Yueting Zhuang, and Qi Tian. Degeneration-tuning: Using scram- bled grid shield unwanted concepts from stable diffusion. In Proceedings of the 31st ACM International Conference on Multimedia, pages 8900–8909, 2023. 2 [40] Alex Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen. Glide: Towards photorealistic image generation and editing with text-guided diffusion models.arXiv preprint arXiv:2112.10741, 2021. 1, 2 [41] OpenAI. Dall·e 3 system card. 2023. 1, 2 [42] OpenAI. Gpt-4 technical report. 2023. 6 [43] Hadas Orgad, Bahjat Kawar, and Yonatan Belinkov. Edit- ing implicit assumptions in text-to-image diffusion models. arXiv preprint arXiv:2303.08084, 2023. 4 [44] Ryan O’Connor. Stable diffusion 1 vs 2 - what you need to know. 2022. 1 [45] Gaurav Parmar, Richard Zhang, and Jun-Yan Zhu.On aliased resizing and surprising subtleties in gan evaluation. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 11410–11420, 2022. 7 [46] Quynh Phung, Songwei Ge, and Jia-Bin Huang. Grounded text-to-image synthesis with attention refocusing.arXiv preprint arXiv:2306.05427, 2023. 4 [47] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervi- sion. InInternational conference on machine learning, pages 8748–8763. PMLR, 2021. 6, 7, 13 [48] Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. Exploring the limits of transfer learning with a unified text-to-text transformer.The Journal of Machine Learning Research, 21(1):5485–5551, 2020. 13 [49] Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image gener- ation with clip latents.arXiv preprint arXiv:2204.06125, 1 (2):3, 2022. 1 [50] Javier Rando, Daniel Paleka, David Lindner, Lennart Heim, and Florian Tram ` er. Red-teaming the stable diffusion safety filter.arXiv preprint arXiv:2210.04610, 2022. 1, 2 [51] Gabriel Raya and Luca Ambrogioni. Spontaneous symme- try breaking in generative diffusion models.arXiv preprint arXiv:2305.19693, 2023. 2, 3, 5 [52] Robin Rombach. Stable diffusion 2.0 release. 2022. 1, 2, 8 [53] Robin Rombach. Stable diffusion v1-4 model card. 2022. 2 [54] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ̈ orn Ommer. High-resolution image synthesis with latent diffusion models. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. 1, 6, 8, 13, 18 [55] Kevin Roose. An ai-generated picture won an art prize. artists aren’t happy. 2022. 1 [56] Simo Ryu.Low-rank adaptation for fast text-to-image 715 diffusion fine-tuning.https://github.com/ cloneofsimo/lora. 5 [57] Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding.Advances in Neural Information Processing Systems, 35:36479–36494, 2022. 1 [58] Hadi Salman, Alaa Khaddaj, Guillaume Leclerc, Andrew Ilyas, and Aleksander Madry. Raising the cost of malicious ai-powered image editing.arXiv preprint arXiv:2302.06588, 2023. 3 [59] Patrick Schramowski, Manuel Brack, Bj ̈ orn Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating inappro- priate degeneration in diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 22522–22531, 2023. 1, 2, 5, 6, 7, 8, 15, 18 [60] Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Worts- man, et al. Laion-5b: An open large-scale dataset for training next generation image-text models.Advances in Neural In- formation Processing Systems, 35:25278–25294, 2022. 1 [61] Riddhi Setty. Ai art generators hit with copyright suit over artists’ images, 2023. 1 [62] Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y Zhao. Glaze: Protecting artists from style mimicry by text-to-image models.arXiv preprint arXiv:2302.04222, 2023. 3 [63] SmithMano. Tutorial: How to remove the safety filter in 5 seconds, 2022. 2 [64] Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli.Deep unsupervised learning using 11 nonequilibrium thermodynamics. InInternational Confer- ence on Machine Learning, pages 2256–2265. PMLR, 2015. 13 [65] Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art or digital forgery? investigating data replication in diffusion models. InPro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6048–6058, 2023. 3 [66] Jiaming Song, Chenlin Meng, and Stefano Ermon.De- noising diffusion implicit models.arXiv preprint arXiv:2010.02502, 2020. 6 [67] Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Ab- hishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equa- tions.arXiv preprint arXiv:2011.13456, 2020. 13 [68] Aaron Van Den Oord, Oriol Vinyals, et al. Neural discrete representation learning.Advances in neural information pro- cessing systems, 30, 2017. 13 [69] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszko- reit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need.Advances in neural information processing systems, 30, 2017. 2, 3, 13 [70] Luisa Verdoliva.Media forensics and deepfakes: an overview.IEEE Journal of Selected Topics in Signal Pro- cessing, 14(5):910–932, 2020. 1 [71] Eric Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not: Learning to forget in text-to- image diffusion models.arXiv preprint arXiv:2303.17591, 2023. 2, 3, 5, 6, 7, 8, 15, 18 [72] Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yi- hua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. To gener- ate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now.arXiv preprint arXiv:2310.11868, 2023. 1 [73] Chen Zhao, Weiling Cai, Chenyu Dong, and Chengwei Hu. Wavelet-based fourier information interaction with fre- quency diffusion adjustment for underwater image restora- tion.arXiv preprint arXiv:2311.16845, 2023. 1 [74] Chen Zhao, Chenyu Dong, and Weiling Cai.Learn- ing a physical-aware diffusion model based on trans- former for underwater image enhancement.arXiv preprint arXiv:2403.01497, 2024. 1 [75] Zhengyue Zhao, Jinhao Duan, Xing Hu, Kaidi Xu, Chenan Wang, Rui Zhang, Zidong Du, Qi Guo, and Yunji Chen. Un- learnable examples for diffusion models: Protect data from unauthorized exploitation.arXiv preprint arXiv:2306.01902, 2023. 3 [76] Dewei Zhou, Zongxin Yang, and Yi Yang. Pyramid diffusion models for low-light image enhancement.arXiv preprint arXiv:2305.10028, 2023. 1 [77] Dewei Zhou, You Li, Fan Ma, Zongxin Yang, and Yi Yang. Migc: Multi-instance generation controller for text-to-image synthesis.arXiv preprint arXiv:2402.05408, 2024. 1 12 Appendix A. Preliminaries Latent diffusion model.Our method is implemented using Stable Diffusion (SD), also known as Latent Diffusion Models (LDM) [54]. This approach conducts the diffusion process within the latent space of an autoencoder. LDM is comprised of two principal components: a vector quantization autoencoder [15, 68] and a diffusion model [13, 20, 26, 54, 64, 67]. The autoencoder undergoes pretraining to transform images into spatial latent codes via an encoderz=E(x), and it can reconstruct the images from these latent codes using a decoderx≈ D(E(x)). The diffusion model, on the other hand, is trained to generate latent codes that exist within the autoencoder’s latent space. The training objective for the diffusion model is defined as follows [20, 54]: L LDM =E z∼E(x),c,ε∼N(0,1),t h ∥ε−ε θ (z t ,t,c)∥ 2 2 i ,(10) wherez t is the noisy latent,tis the timestep,εis a standard Gaussian noise sample,ε θ is the denoising network, andcis the conditioning embeddings, which can be encoded from text prompts, class labels, segmentation masks, among others [54]. During the inference process, Gaussian noise is sampled as a starting pointz T and successively denoised to produce a new latent codez 0 through the well-trained denoising networkε θ . Ultimately, this latent code is transformed into an image via the pretrained decoderx 0 ≈D(z 0 ). Cross-attention in text-to-image diffusion models.In text-to-image diffusion models, cross-attention mechanisms serve as the pivotal interface for the interplay between image and text modalities. Initially, a text prompt undergoes tokenization, converting it into a series of unique token embeddings. These embeddings are then processed by a text encoder (e.g., CLIP [47] or T5 [48]), resulting in a final set of embeddings, denoted asP= [e 1 e 2 ·e y ], wherein each token’s embedding e i is enriched with information from the entire token sequence. These enhanced embeddings are subsequently introduced into the cross-attention modules, where they act as navigational beacons for the image synthesis process. At certain layer land timestept, the text embeddings are mapped using projection matrices,W k andW v , to obtain the ‘Keys’k t,l and ‘Values’v t,l , respectively. Concurrently, the image’s features,f t,l , undergo the projectionW q to form the ‘Queries’q t,l . The cross-attention mechanism computes the attention map as [54, 69]: A t,l =softmax q t,l ·k T t,l √ d ! ,(11) wheredis the scaling factor to normalize the dot product. The module then synthesizes image features by aggregating ‘Values’ with the attention weights,o t,l =A t,l ·v t,l . This process ensures that the generated images are intricately aligned with the input text, completing the text-to-image generation with high fidelity. B. Closed-Form Solution Proof In this section, we present a detailed derivation of the closed-form solution as written in Eq. (2). Our goal is to determine a refined matrix, denoted asW ′ k ∈R d 1 ×d 2 , which encourages the model to refrain from embedding residual information of the target phrase into other words, while preserving the prior knowledge. The loss function is defined in Eq. (1), which is: L(W ′ k ) = n X i=1 W ′ k ·e f i −W k ·e g i 2 2 +λ 1 n+m X i=n+1 ∥W ′ k ·e p i −W k ·e p i ∥ 2 2 , whereλ 1 ∈R + is a hyperparameter,e f i ∈R d 2 is the embedding of a word co-existing with the target phrase,e g i ∈R d 2 is the embedding of that word when the target phrase is replaced with its super-category or a generic one,e p i ∈R d 2 is the embedding for preserving the prior,W k ∈R d 1 ×d 2 is the pretrained weights, andn,mare the number of embeddings for mapping and preserving, respectively. 13 To seek the optimalW ′ k , we differentiate the loss function with respect to it and set the derivative equal to zero: ∂L(W ′ k ) ∂W ′ k = 2 n X i=1 W ′ k ·e f i −W k ·e g i (e f i ) T + 2λ 1 n+m X i=n+1 (W ′ k ·e p i −W k ·e p i ) (e p i ) T = 0(12) n X i=1 W ′ k ·e f i ·(e f i ) T − n X i=1 W k ·e g i ·(e f i ) T +λ 1 n+m X i=n+1 W ′ k ·e p i ·(e p i ) T −λ 1 n+m X i=n+1 W k ·e p i ·(e p i ) T = 0(13) n X i=1 W ′ k ·e f i ·(e f i ) T +λ 1 n+m X i=n+1 W ′ k ·e p i ·(e p i ) T = n X i=1 W k ·e g i ·(e f i ) T +λ 1 n+m X i=n+1 W k ·e p i ·(e p i ) T (14) W ′ k n X i=1 e f i ·(e f i ) T +λ 1 n+m X i=n+1 e p i ·(e p i ) T ! = n X i=1 W k ·e g i ·(e f i ) T +λ 1 n+m X i=n+1 W k ·e p i ·(e p i ) T (15) W ′ k = n X i=1 W k ·e g i ·(e f i ) T +λ 1 n+m X i=n+1 W k ·e p i ·(e p i ) T ! · n X i=1 e f i ·(e f i ) T +λ 1 n+m X i=n+1 e p i ·(e p i ) T ! −1 .(16) To ensure the validity of the final step, it is crucial that the symmetric real matrix P n i=1 e f i ·(e f i ) T +λ 1 P n+m i=n+1 e p i ·(e p i ) T is full rank. For any non-zero vectorx∈R d 2 , we examine the following quadratic form: x T · n X i=1 e f i ·(e f i ) T +λ 1 n+m X i=n+1 e p i ·(e p i ) T ! ·x= n X i=1 x T e f i · x T e f i T +λ 1 n+m X i=n+1 x T e p i · x T e p i T (17) = n X i=1 x T e f i 2 2 +λ 1 n+m X i=n+1 x T e p i 2 2 ≥0.(18) The prior preserving embeddingse p i are computed by default using the MS-COCO dataset [32]. Due to the extensive number of terms involved in the summation, it is highly improbable for all terms x T e p i 2 2 in the sum to equal zero. Hence, in general cases, the matrix P n i=1 e f i ·(e f i ) T +λ 1 P n+m i=n+1 e p i ·(e p i ) T is positive definite and thus invertible. The derivation is applicable toW ′ v as well. In addition to retaining general prior knowledge, akin to UCE [17], our framework extends support to allow users to highlight and preserve domain-specific concepts. This functionality is absent in most preceding frameworks. For instance, when two concepts share a strong correlation, removing one could potentially impair the generation quality of the other, which might be intended for preservation. Both general and domain-specific prior knowledge can be incorporated into the second term of Eq. (1). We set a weighting factorλ 3 to calibrate the significance attributed to each type of knowledge. Thus, Eq. (2) can be reformulated as follows: W ′ k =   n X i=1 W k ·e g i ·(e f i ) T +λ 1 n+m ′ X i=n+1 W k ·e p i ·(e p i ) T +λ 3 n+m X i=n+m ′ W k ·e p i ·(e p i ) T   ·   n X i=1 e f i ·(e f i ) T +λ 1 n+m ′ X i=n+1 e p i ·(e p i ) T +λ 3 n+m X i=n+m ′ e p i ·(e p i ) T   −1 , (19) where we havem ′ terms of general knowledge andm−m ′ terms of domain-specific knowledge. C. Implementation Details C.1. Experimental Setup Details Object erasure.To assess the generality of erasure, we prepare three synonyms for each of the ten object classes in the CIFAR-10 dataset [29]. These synonyms are listed in Table 6. Since the object classes lack proper super-categories, we allocate generic concepts (e.g., sky or ground) to them, as also presented in Table 6. To evaluate the erasure capability of 14 Table 6. The synonyms and mapping concepts for the ten object classes in the CIFAR-10 dataset. Object Classes AirplaneAutomobile BirdCatDeerDogFrogHorseShipTruck Synonyms AircraftCarAvianFelineHartCanineAmphibianEquineVesselLorry PlaneVehicleFowlKittyStagPoochAnuranSteedBoatRig JetMotorcarWinged Creature HousecatDoeHoundTadpoleMountWatercraftHauler Mapping Concepts (Randomly Sampled) GroundSkyStreetForestStreetSkyForestForestGroundSky different methods, we use each finetuned model to generate 200, 600, and 1,800 images for three categories: the erased object (efficacy), its three synonyms (generality), and nine remaining objects (specificity). For the erased object, the prompt is‘a photo of theerased class name’. For the three synonyms of the erased object, we use the prompt‘a photo of thesynonym of erased class name’. Lastly, for each of the nine remaining unaltered objects, the prompt is‘a photo of theunaltered class name’. Celebrity erasure.For assessing the task of multiple celebrity erasure, we establish a dataset consisting of 200 celebri- ties. Their portraits generated by SD v1.4 are recognizable with exceptional accuracy by the GIPHY Celebrity Detector (GCD) [18]. This dataset is divided into two groups: an erasure group with 100 celebrities and a retention group with 100 other celebrities. The full list for both groups is presented in Table 7. For evaluating the task of celebrity erasure, we use five text prompts to generate images. These prompts are as follows:‘a portrait ofcelebrity name’, ‘a sketch ofcelebrity name’, ‘an oil painting ofcelebrity name’, ‘celebrity namein an official photo’,and‘an image capturingcelebrity nameat a public event’.The detailed breakdown of the number of images generated for each experiment is presented in Table 8. Explicit content erasure.We adopt the same setting used in SA [19] to erase ‘nudity’, ‘naked’, ‘erotic’, and ‘sextual’ from SD v1.4. The mapping concept is set as ‘a person wearing clothes’. Artistic style erasure.We utilize the Image Synthesis Style Studies Database [23], which compiles a list of artists whose styles can be replicated by SD v1.4. From this database, we sample 200 artists and split them into two groups: an erasure group of 100 artists and a retention group with 100 other artists. The full list for both groups is presented in Table 9. To assess efficacy and specificity, we apply the same five prompts and seeds as in [17] for both the erased and retained artists group. These prompts include‘Image in the style ofartist name’, ‘Art inspired byartist name’, ‘Painting in the style ofartist name’, ‘A reproduction of art byartist name’and‘A famous artwork byartist name’. For each of 100 artists, we use each prompt to generate five images, resulting in 25 images per artist. Thus, this yields 2500 images for each group. C.2. Training Configurations Implementation of previous works.In our series of four experiments, we focus on comparing our proposed method with existing methods, including ESD-u 1 [16], ESD-x [16], FMN 2 [71], SLD-M 3 [59], UCE 4 [17], AC 5 [30], and SA 6 [19]. Notably, SA [19] demands extensive resources, requiring 4 RTX A6000s and over 12 hours of training for concept erasure. Consequently, we have not replicated their findings due to these extensive requirements. Instead, we align our explicit content erasure task with SA’s settings [19], and we employ their reported experimental results for our comparative analysis. Beyond SA [19], we implement each existing method following their recommended configurations for various erasure types (such as objects, style, or nudity). It is important to note that several methods (e.g., FMN [71] and AC [30]) are not tailored for erasing multiple concepts. In our preliminary tests, we observe that without altering the algorithm or further tuning the suggested parameters, training for multiple concepts—either sequentially or in parallel—yielded comparably mediocre results, marked by either inadequate specificity or generality. Consequently, we opt for a parallel training manner for them when erasing multiple concepts to save resources. 1 https://github.com/rohitgandikota/erasing 2 https://github.com/SHI-Labs/Forget-Me-Not 3 https://github.com/ml-research/safe-latent-diffusion 4 https://github.com/rohitgandikota/unified-concept-editing 5 https://github.com/nupurkmr9/concept-ablation 6 https://github.com/clear-nus/selective-amnesia 15 Table 7.The Evaluation Setup for Celebrity Erasure:Our celebrity dataset contains an erasure group with 100 celebrities and a retention group with another 100 celebrities. Portraits of these celebrities can be effectively generated using SD v1.4. The generated portraits are accurately recognizable by the GIPHY Celebrity Detector (GCD) with an accuracy exceeding 99%. To perform erasure experiments involving 1, 5, 10, and 100 celebrities, a corresponding number of celebrities are selected from the erasure group for each experiment. In all cases, the entire retention group is utilized. Group # of Celebrities to Be Erased Mapping Concept Celebrity Erasure Group 1‘a woman’‘Melania Trump’ 5‘a person’‘Adam Driver’, ‘Adriana Lima’, ‘Amber Heard’, ‘Amy Adams’, ‘Andrew Garfield’ 10‘a person’ ‘Adam Driver’, ‘Adriana Lima’, ‘Amber Heard’, ‘Amy Adams’, ‘Andrew Garfield’, ‘Angelina Jolie’, ‘Anjelica Huston’, ‘Anna Faris’, ‘Anna Kendrick’, ‘Anne Hathaway’ 100‘a person’ ‘Adam Driver’, ‘Adriana Lima’, ‘Amber Heard’, ‘Amy Adams’, ‘Andrew Garfield’, ‘Angelina Jolie’, ‘Anjelica Huston’, ‘Anna Faris’, ‘Anna Kendrick’, ‘Anne Hathaway’, ‘Arnold Schwarzenegger’, ‘Barack Obama’, ‘Beth Behrs’, ‘Bill Clinton’, ‘Bob Dylan’, ‘Bob Marley’, ‘Bradley Cooper’, ‘Bruce Willis’, ‘Bryan Cranston’, ‘Cameron Diaz’, ‘Channing Tatum’, ‘Charlie Sheen’, ‘Charlize Theron’, ‘Chris Evans’, ‘Chris Hemsworth’, ‘Chris Pine’, ‘Chuck Norris’, ‘Courteney Cox’, ‘Demi Lo- vato’, ‘Drake’, ‘Drew Barrymore’, ‘Dwayne Johnson’, ‘Ed Sheeran’, ‘Elon Musk’, ‘Elvis Pres- ley’, ‘Emma Stone’, ‘Frida Kahlo’, ‘George Clooney’, ‘Glenn Close’, ‘Gwyneth Paltrow’, ‘Har- rison Ford’, ‘Hillary Clinton’, ‘Hugh Jackman’, ‘Idris Elba’, ‘Jake Gyllenhaal’, ‘James Franco’, ‘Jared Leto’, ‘Jason Momoa’, ‘Jennifer Aniston’, ‘Jennifer Lawrence’, ‘Jennifer Lopez’, ‘Jeremy Renner’, ‘Jessica Biel’, ‘Jessica Chastain’, ‘John Oliver’, ‘John Wayne’, ‘Johnny Depp’, ‘Ju- lianne Hough’, ‘Justin Timberlake’, ‘Kate Bosworth’, ‘Kate Winslet’, ‘Leonardo Dicaprio’, ‘Margot Robbie’, ‘Mariah Carey’, ‘Melania Trump’, ‘Meryl Streep’, ‘Mick Jagger’, ‘Mila Kunis’, ‘Milla Jovovich’, ‘Morgan Freeman’, ‘Nick Jonas’, ‘Nicolas Cage’, ‘Nicole Kidman’, ‘Octavia Spencer’, ‘Olivia Wilde’, ‘Oprah Winfrey’, ‘Paul Mccartney’, ‘Paul Walker’, ‘Peter Dinklage’, ‘Philip Sey- mour Hoffman’, ‘Reese Witherspoon’, ‘Richard Gere’, ‘Ricky Gervais’, ‘Rihanna’, ‘Robin Williams’, ‘Ronald Reagan’, ‘Ryan Gosling’, ‘Ryan Reynolds’, ‘Shia Labeouf ’, ‘Shirley Temple’, ‘Spike Lee’, ‘Stan Lee’, ‘Theresa May’, ‘Tom Cruise’, ‘Tom Hanks’, ‘Tom Hardy’, ‘Tom Hiddleston’, ‘Whoopi Goldberg’, ‘Zac Efron’, ‘Zayn Malik’ Retention Group 1, 5, 10, and 100- ‘Aaron Paul’, ‘Alec Baldwin’, ‘Amanda Seyfried’, ‘Amy Poehler’, ‘Amy Schumer’, ‘Amy Winehouse’, ‘Andy Samberg’, ‘Aretha Franklin’, ‘Avril Lavigne’, ‘Aziz Ansari’, ‘Barry Manilow’, ‘Ben Affleck’, ‘Ben Stiller’, ‘Benicio Del Toro’, ‘Bette Midler’, ‘Betty White’, ‘Bill Murray’, ‘Bill Nye’, ‘Brit- ney Spears’, ‘Brittany Snow’, ‘Bruce Lee’, ‘Burt Reynolds’, ‘Charles Manson’, ‘Christie Brinkley’, ‘Christina Hendricks’, ‘Clint Eastwood’, ‘Countess Vaughn’, ‘Dakota Johnson’, ‘Dane Dehaan’, ‘David Bowie’, ‘David Tennant’, ‘Denise Richards’, ‘Doris Day’, ‘Dr Dre’, ‘Elizabeth Taylor’, ‘Emma Roberts’, ‘Fred Rogers’, ‘Gal Gadot’, ‘George Bush’, ‘George Takei’, ‘Gillian Anderson’, ‘Gordon Ramsey’, ‘Halle Berry’, ‘Harry Dean Stanton’, ‘Harry Styles’, ‘Hayley Atwell’, ‘Heath Ledger’, ‘Henry Cavill’, ‘Jackie Chan’, ‘Jada Pinkett Smith’, ‘James Garner’, ‘Jason Statham’, ‘Jeff Bridges’, ‘Jennifer Connelly’, ‘Jensen Ackles’, ‘Jim Morrison’, ‘Jimmy Carter’, ‘Joan Rivers’, ‘John Lennon’, ‘Johnny Cash’, ‘Jon Hamm’, ‘Judy Garland’, ‘Julianne Moore’, ‘Justin Bieber’, ‘Kaley Cuoco’, ‘Kate Upton’, ‘Keanu Reeves’, ‘Kim Jong Un’, ‘Kirsten Dunst’, ‘Kristen Stewart’, ‘Krysten Ritter’, ‘Lana Del Rey’, ‘Leslie Jones’, ‘Lily Collins’, ‘Lindsay Lohan’, ‘Liv Tyler’, ‘Lizzy Caplan’, ‘Maggie Gyllenhaal’, ‘Matt Damon’, ‘Matt Smith’, ‘Matthew Mcconaughey’, ‘Maya An- gelou’, ‘Megan Fox’, ‘Mel Gibson’, ‘Melanie Griffith’, ‘Michael Cera’, ‘Michael Ealy’, ‘Natalie Portman’, ‘Neil Degrasse Tyson’, ‘Niall Horan’, ‘Patrick Stewart’, ‘Paul Rudd’, ‘Paul Wesley’, ‘Pierce Brosnan’, ‘Prince’, ‘Queen Elizabeth’, ‘Rachel Dratch’, ‘Rachel Mcadams’, ‘Reba Mcen- tire’, ‘Robert De Niro’ Table 8. The detailed breakdown of the number (#) of images generated for each celebrity erasure experiment. # of Celebrities to Be Erased Celebrity Group # of Images Generated for Each Celebrity Total # of Generated Images 1 Erasure Group250250 Retention Group252500 5 Erasure Group50250 Retention Group252500 10 Erasure Group25250 Retention Group252500 100 Erasure Group252500 Retention Group252500 16 Table 9.The Evaluation Setup for Artistic Style Erasure:We sample 200 artists from the Image Synthesis Style Studies Database [23]. They are split into two groups: an erasure group with 100 artists and a retention group with another 100 artists. The artworks of these artists can be successfully replicated by SD v1.4. Group # of Artistic Styles to Be Erased Mapping Concept Artist Erasure Group 100‘art’ ‘Brent Heighton’, ‘Brett Weston’, ‘Brett Whiteley’, ‘Brian Bolland’, ‘Brian Despain’, ‘Brian Froud’, ‘Brian K. Vaughan’, ‘Brian Kesinger’, ‘Brian Mashburn’, ‘Brian Oldham’, ‘Brian Stelfreeze’, ‘Brian Sum’, ‘Briana Mora’, ‘Brice Marden’, ‘Bridget Bate Tichenor’, ‘Briton Rivi ` ere’, ‘Brooke Didonato’, ‘Brooke Shaden’, ‘Brothers Grimm’, ‘Brothers Hildebrandt’, ‘Bruce Munro’, ‘Bruce Nauman’, ‘Bruce Pennington’, ‘Bruce Timm’, ‘Bruno Catalano’, ‘Bruno Munari’, ‘Bruno Walpoth’, ‘Bryan Hitch’, ‘Butcher Billy’, ‘C. R. W. Nevinson’, ‘Cagnaccio Di San Pietro’, ‘Camille Corot’, ‘Camille Pissarro’, ‘Camille Walala’, ‘Canaletto’, ‘Candido Portinari’, ‘Carel Willink’, ‘Carl Barks’, ‘Carl Gustav Carus’, ‘Carl Holsoe’, ‘Carl Larsson’, ‘Carl Spitzweg’, ‘Carlo Crivelli’, ‘Carlos Schwabe’, ‘Carmen Saldana’, ‘Carne Griffiths’, ‘Casey Weldon’, ‘Caspar David Friedrich’, ‘Cassius Marcel- lus Coolidge’, ‘Catrin Welz-Stein’, ‘Cedric Peyravernay’, ‘Chad Knight’, ‘Chantal Joffe’, ‘Charles Addams’, ‘Charles Angrand’, ‘Charles Blackman’, ‘Charles Camoin’, ‘Charles Dana Gibson’, ‘Charles E. Burchfield’, ‘Charles Gwathmey’, ‘Charles Le Brun’, ‘Charles Liu’, ‘Charles Schridde’, ‘Charles Schulz’, ‘Charles Spencelayh’, ‘Charles Vess’, ‘Charles-Francois Daubigny’, ‘Charlie Bowater’, ‘Charline Von Heyl’, ‘Cha ̈ ım Soutine’, ‘Chen Zhen’, ‘Chesley Bonestell’, ‘Chiharu Sh- iota’, ‘Ching Yeh’, ‘Chip Zdarsky’, ‘Chris Claremont’, ‘Chris Cunningham’, ‘Chris Foss’, ‘Chris Leib’, ‘Chris Moore’, ‘Chris Ofili’, ‘Chris Saunders’, ‘Chris Turnham’, ‘Chris Uminga’, ‘Chris Van Allsburg’, ‘Chris Ware’, ‘Christian Dimitrov’, ‘Christian Grajewski’, ‘Christophe Vacher’, ‘Christo- pher Balaskas’, ‘Christopher Jin Baron’, ‘Chuck Close’, ‘Cicely Mary Barker’, ‘Cindy Sherman’, ‘Clara Miller Burd’, ‘Clara Peeters’, ‘Clarence Holbrook Carter’, ‘Claude Cahun’, ‘Claude Monet’, ‘Clemens Ascher’ Retention Group 100- ‘A.J.Casson’, ‘Aaron Douglas’, ‘Aaron Horkey’, ‘Aaron Jasinski’, ‘Aaron Siskind’, ‘Abbott Fuller Graves’, ‘Abbott Handerson Thayer’, ‘Abdel Hadi Al Gazzar’, ‘Abed Abdi’, ‘Abigail Larson’, ‘Abraham Mintchine’, ‘Abraham Pether’, ‘Abram Efimovich Arkhipov’, ‘Adam Elsheimer’, ‘Adam Hughes’, ‘Adam Martinakis’, ‘Adam Paquette’, ‘Adi Granov’, ‘Adolf Hir ́ emy-Hirschl’, ‘Adolph Got- tlieb’, ‘Adolph Menzel’, ‘Adonna Khare’, ‘Adriaen van Ostade’, ‘Adriaen van Outrecht’, ‘Adrian Donoghue’, ‘Adrian Ghenie’, ‘Adrian Paul Allinson’, ‘Adrian Smith’, ‘Adrian Tomine’, ‘Adri- anus Eversen’, ‘Afarin Sajedi’, ‘Affandi’, ‘Aggi Erguna’, ‘Agnes Cecile’, ‘Agnes Lawrence Pel- ton’, ‘Agnes Martin’, ‘Agostino Arrivabene’, ‘Agostino Tassi’, ‘Ai Weiwei’, ‘Ai Yazawa’, ‘Akihiko Yoshida’, ‘Akira Toriyama’, ‘Akos Major’, ‘Akseli Gallen-Kallela’, ‘Al Capp’, ‘Al Feldstein’, ‘Al Williamson’, ‘Alain Laboile’, ‘Alan Bean’, ‘Alan Davis’, ‘Alan Kenny’, ‘Alan Lee’, ‘Alan Moore’, ‘Alan Parry’, ‘Alan Schaller’, ‘Alasdair McLellan’, ‘Alastair Magnaldo’, ‘Alayna Lemmer’, ‘Al- bert Benois’, ‘Albert Bierstadt’, ‘Albert Bloch’, ‘Albert Dubois-Pillet’, ‘Albert Eckhout’, ‘Albert Edelfelt’, ‘Albert Gleizes’, ‘Albert Goodwin’, ‘Albert Joseph Moore’, ‘Albert Koetsier’, ‘Albert Kotin’, ‘Albert Lynch’, ‘Albert Marquet’, ‘Albert Pinkham Ryder’, ‘Albert Robida’, ‘Albert Servaes’, ‘Albert Tucker’, ‘Albert Watson’, ‘Alberto Biasi’, ‘Alberto Burri’, ‘Alberto Giacometti’, ‘Alberto Magnelli’, ‘Alberto Seveso’, ‘Alberto Sughi’, ‘Alberto Vargas’, ‘Albrecht Anker’, ‘Albrecht Durer’, ‘Alec Soth’, ‘Alejandro Burdisio’, ‘Alejandro Jodorowsky’, ‘Aleksey Savrasov’, ‘Aleksi Briclot’, ‘Alena Aenami’, ‘Alessandro Allori’, ‘Alessandro Barbucci’, ‘Alessandro Gottardo’, ‘Alessio Albi’, ‘Alex Alemany’, ‘Alex Andreev’, ‘Alex Colville’, ‘Alex Figini’, ‘Alex Garant’ Implementation of MACE.This section details the implementation of MACE, focusing on the hyperparameters applied across various experimental scenarios, as outlined in Table 10. For the erasure of explicit content, we leverage general prior knowledge estimated from the MSCOCO dataset, without incorporating any domain-specific knowledge. For the erasure of celebrity likenesses and artistic styles, MACE again utilizes the general prior knowledge from the MSCOCO dataset. Additionally, domain-specific knowledge is employed, which is calculated based on the corresponding retention groups that users wish to preserve. Object erasure presents a special case where the prior knowledge from the MSCOCO dataset includes the concepts we aim to erase (e.g., cat, dog, or airplane). Thus, a direct application of the standard approach is not feasible. To address this, we modify the loss function. Instead of using the second term in Eq. (1), we use∥W ′ k −W k ∥ 2 2 to preserve the original knowledge. D. Additional Evaluation Results of Erasing the CIFAR-10 Classes Table 11 presents the results of erasing the final six object classes of the CIFAR-10 dataset [29]. Our approach achieves the highest harmonic mean across the erasure of these six object classes. This highlights the exceptional erasure capabilities of our approach, effectively balancing specificity and generality. 17 Table 10.Hyperparameters Utilized in MACE Across Different Experimental Sets. Erasure TypeSegmentLoRA Training StepLearning Rateλ 1 =λ 2 λ 3 Rankr Object Airplane501.0×10 −5 1000.0-1 Automobile501.0×10 −5 100.0-1 Bird501.0×10 −5 10.0-1 Cat501.0×10 −5 1000.0-1 Deer501.0×10 −5 10.0-1 Dog501.0×10 −5 10.0-1 Frog501.0×10 −5 0.4-1 Horse501.0×10 −5 1.0-1 Ship501.0×10 −5 1000.0-1 Truck501.0×10 −5 0.1-1 Celebrity 1 Celebrity501.0×10 −4 1.0×10 −4 0.81 5 Celebrities501.0×10 −4 1.0×10 −4 5.01 10 Celebrities501.0×10 −4 1.0×10 −4 8.01 100 Celebrities501.0×10 −4 1.0×10 −4 20.01 Artistic Style100 Artistic Styles501.0×10 −4 1.0×10 −4 8.01 Explicit Content ‘Nudity’, ‘Naked’, ‘Erotic’, ‘Sexual’. 1201.0×10 −5 7.0×10 −7 -1 Table 11.Evaluation of Erasing the CIFAR-10 Classes:Results for the final six individual classes are presented. CLIP classification accuracies are reported for each erased class in three sets: the erased class itself (Acc e , efficacy), the nine remaining unaffected classes (Acc s , specificity), and three synonyms of the erased class (Acc g , generality). The harmonic meansH o reflect the comprehensive erasure capability. All presented values are denoted in percentage (%). The classification accuracies of images generated by the original SD v1.4 are presented for reference. Method Deer ErasedDog ErasedFrog ErasedHorse ErasedShip ErasedTruck Erased Acc e ↓Acc s ↑Acc g ↓H o ↑Acc e ↓Acc s ↑Acc g ↓H o ↑Acc e ↓Acc s ↑Acc g ↓H o ↑Acc e ↓Acc s ↑Acc g ↓H o ↑Acc e ↓Acc s ↑Acc g ↓H o ↑Acc e ↓Acc s ↑Acc g ↓H o ↑ FMN [71]98.9594.1360.243.0497.6498.1296.953.9491.6094.5963.6119.1099.6393.1446.611.1097.9798.2196.753.7097.6497.8695.374.62 AC [30]99.4598.4764.781.6298.5098.5795.763.2999.9298.6292.440.2499.7498.6345.290.7798.1898.5077.474.9798.5098.6195.123.40 UCE [17]11.8898.398.9492.3413.2298.6914.6389.9020.8698.3218.5085.534.6698.3212.7093.426.1398.4121.4489.4420.5898.1650.0070.13 SLD-M [59]57.6298.4539.9159.5394.2798.5382.8412.3581.9298.1959.7833.2081.7698.4436.7137.1489.2498.5641.0224.9991.0698.7280.6217.29 ESD-x [16]19.0196.9810.1988.7728.5496.3844.4970.7811.5697.3713.7390.4516.8697.0215.0587.9633.3597.9334.7873.9936.0697.2444.2968.38 ESD-u [16]18.1473.816.9382.1727.0389.7528.5277.2412.3288.057.6289.3217.6982.239.8984.7318.3894.3215.9386.3326.1185.3521.4778.98 Ours13.4797.716.08 92.4811.0796.7710.8691.4711.4597.7513.0890.834.8997.487.8594.868.5898.5614.4091.567.2998.389.3893.79 SD v1.4 [54]99.8798.4970.02-98.7498.6298.25-99.9398.4992.04-99.7898.5045.74-98.6498.6364.16-98.8998.6095.00- E. Concept-Focal Importance Sampling Figure 9. The graph of probability density function of timesteptfor reference. Figure 9 presents a graph plotting the probability density functionξ(t)defined in Eq. (5), which is: ξ(t) = 1 Z (σ(γ(t−t 1 ))−σ(γ(t−t 2 ))), whereZis a normalizer,σ(x)is the sigmoid function1/(1 +e −x ), witht 1 andt 2 as the bounds of a high probability sampling interval(t 1 < t 2 ), andγ as a temperature hyperparameter. We sett 1 = 200,t 2 = 400, andγ= 0.05 throughout our experiments. 18 Generated Image“catonthebeach” Normal Generation Replacing the text embedding of ‘cat’ with that of the final [EOS] token Normal Generation Replacing the text embedding of ‘horse’ with that of the final [EOS] token Generated Image“horseontheplain” Normal Generation Replacing the text embedding of ‘car’ with that of the final [EOS] token (a) Example 1(b) Example 2 Generated Image“caronthestreet” (c) Example 3 Normal Generation Replacing the text embedding of ‘ship’ with that of the final [EOS] token (d) Example 4 Generated Image“shiponthelake” Figure 10.Additional Examples of Generating Concepts Using Residual Information:In every example presented, the first row illus- trates images normally generated by SD v1.4, while the second row displays images generated after replacing the text embedding of the key concept with that of the final[EOS]token. Despite this replacement of the key concept’s text embedding, the attention maps of the remaining words distinctly highlight the contours of the intended concept, exhibiting a high activation value. F. Additional Qualitative Results Table 12. Summary of tasks with their figure indices. Erasure TypeSegmentFigure Index Object Erasure AirplaneFigure 11 AutomobileFigure 12 BirdFigure 13 CatFigure 14 DeerFigure 15 DogFigure 16 FrogFigure 17 HorseFigure 18 ShipFigure 19 TruckFigure 20 Celebrity Erasure 1 CelebrityFigure 21 5 CelebritiesFigure 22 10 CelebritiesFigure 23 100 Celebrities Figure 24 Figure 25 Artistic Style Erasure 100 Artistic StylesFigure 26 Explicit Content Erasure -Figure 27 Figure 10 provides further instances of concept generation utiliz- ing residual information. Despite substituting the text embedding of the core concept with that of the final[EOS]token, the at- tention maps corresponding to the remaining words clearly delin- eate the contours of the targeted concept. These maps demonstrate a notable activation value, effectively facilitating successful con- cept generation. Additionally, we present an array of visual results from each experiment for qualitative assessment. The correspond- ing figure indices are listed in Table 12. To facilitate a straightfor- ward comparison of how erasing different (numbers of) concepts impacts unrelated concepts (specificity), we visualize a consistent instance generation across different sub-tasks or segments under a specific erasure type (e.g., car for object erasure or Bill Murray for celebrity erasure). 19 Efficacy: ‘a photo of the airplane’ Generality: ‘a photo of the aircraft’ Specificity: ‘a photo of the automobile’ 18,19 28,29 58,59 SD v1.4UCESLD-MESD-xESD-uOursACFMN 23,24 4,5 9,10 23,24 9,10 17,18 Figure 11. Qualitative comparison onairplane erasure. The images on the same row are generated using the same random seed. 20 Efficacy: ‘a photo of the automobile’ Specificity: ‘a photo of the truck’ Generality: ‘a photo of the car’ 10 18 33 SD v1.4UCESLD-MESD-xESD-uOursACFMN 3 4 9 5 6 10 Figure 12. Qualitative comparison onautomobile erasure. The images on the same row are generated using the same random seed. 21 Efficacy: ‘a photo of the bird’ Generality: ‘a photo of the avian’ Specificity: ‘a photo of the automobile’ 19 27 33 SD v1.4UCESLD-MESD-xESD-uOursACFMN 24 5 10 6 27 33 Figure 13. Qualitative comparison onbird erasure. The images on the same row are generated using the same random seed. 22 Efficacy: ‘a photo of the cat’ Generality: ‘a photo of the feline’ Specificity: ‘a photo of the automobile’ 1 10 16 SD v1.4UCESLD-MESD-xESD-uOursACFMN 24 5 10 3 12 62 Figure 14. Qualitative comparison oncat erasure. The images on the same row are generated using the same random seed. 23 Efficacy: ‘a photo of the deer’ Generality: ‘a photo of the doe’ Specificity: ‘a photo of the automobile’ 7 64 90 SD v1.4UCESLD-MESD-xESD-uOursACFMN 24 5 10 6 27 50 Figure 15. Qualitative comparison ondeer erasure. The images on the same row are generated using the same random seed. 24 Efficacy: ‘a photo of the dog’ Generality: ‘a photo of the canine’ Specificity: ‘a photo of the automobile’ 6 41 44 SD v1.4UCESLD-MESD-xESD-uOursACFMN 24 5 10 8 33 41 Figure 16. Qualitative comparison ondog erasure. The images on the same row are generated using the same random seed. 25 Efficacy: ‘a photo of the frog’ Generality: ‘a photo of the amphibian’ Specificity: ‘a photo of the automobile’ 21 61 96 SD v1.4UCESLD-MESD-xESD-uOursACFMN 24 5 10 1 5 21 Figure 17. Qualitative comparison onfrog erasure. The images on the same row are generated using the same random seed. 26 Efficacy: ‘a photo of the horse’ Generality: ‘a photo of the equine’ Specificity: ‘a photo of the automobile’ 17 33 36 SD v1.4UCESLD-MESD-xESD-uOursACFMN 24 5 10 6 8 33 Figure 18. Qualitative comparison onhorse erasure. The images on the same row are generated using the same random seed. 27 Efficacy: ‘a photo of the ship’ Generality: ‘a photo of the boat’ Specificity: ‘a photo of the automobile’ 6 18 26 SD v1.4UCESLD-MESD-xESD-uOursACFMN 24 5 10 6 8 81 Figure 19. Qualitative comparison onship erasure. The images on the same row are generated using the same random seed. 28 Efficacy: ‘a photo of the truck’ Generality: ‘a photo of the hauler’ Specificity: ‘a photo of the automobile’ 5 17 25 SD v1.4UCESLD-MESD-xESD-uOursACFMN 24 5 10 18 20 44 Figure 20. Qualitative comparison ontruck erasure. The images on the same row are generated using the same random seed. 29 Efficacy: ‘a portrait of Melania Trump’ Efficacy: ‘a sketch of Melania Trump’ Seed 4,6 Specificity: ‘a sketch of Bill Murray’ Specificity: ‘a portrait of Amanda Seyfried’ SD v1.4UCESLD-MESD-xESD-uOursACFMN Seed 13,9 Seed 1,3 Seed 2,3 Figure 21. Qualitative comparison on1-celebrity erasure. The images on the same row are generated using the same random seed. Melania Trump is in the erasure group, while Bill Murray and Amanda Seyfried are in the retention group (See Table 7). 30 Efficacy: ‘a portrait of Adam Driver’ Efficacy: ‘a sketch of Amber Heard’ UCESLD-MESD-xESD-uOurs AC FMN Specificity: ‘a sketch of Bill Murray’ Specificity: ‘a portrait of Amanda Seyfried’ SD v1.4UCESLD-MESD-xESD-uOursACFMN Seed 2,3 Seed 8,9 Seed 1,3 Seed 2,3 Figure 22. Qualitative comparison on5-celebrity erasure. The images on the same row are generated using the same random seed. Adam Driver and Amber Heard are in the erasure group, while Bill Murray and Amanda Seyfried are in the retention group (See Table 7). 31 Efficacy: ‘A portrait of Angelina Jolie’ Efficacy: ‘A portrait of Anna Kendrick’ Specificity: ‘a sketch of Bill Murray’ Specificity: ‘a portrait of Amanda Seyfried’ SD v1.4UCESLD-MESD-xESD-uOursACFMN Seed 34,48 Seed 6,23 Seed 1,3 Seed 2,3 Figure 23. Qualitative comparison on10-celebrity erasure. The images on the same row are generated using the same random seed. Angelina Jolie and Anna Kendrick are in the erasure group, while Bill Murray and Amanda Seyfried are in the retention group (See Table 7). 32 Efficacy: ‘A portrait of Emma Stone’ Efficacy: ‘A portrait of Obama Brarack’ Specificity: ‘A portrait of Emma Roberts’ Specificity: ‘A portrait of Alec Baldwin’ SD v1.4UCESLD-MESD-xESD-uOursACFMN Seed 6,23 Seed 11,44 Seed 11,20 Seed 13,17 Figure 24. Qualitative comparison on100-celebrity erasure. The images on the same row are generated using the same random seed. Emma Stone and Obama Brarack are in the erasure group, while Emma Roberts and Alec Baldwin are in the retention group (See Table 7). 33 Efficacy: ‘A portrait of John Wayne’ Efficacy: ‘A portrait of Tom Hiddleston’ Specificity: ‘A portrait of John Lennon’ Specificity: ‘A portrait of Gal Gadot’ SD v1.4UCESLD-MESD-xESD-uOursACFMN Seed 22,24 Seed 4,34 Seed 34,38 Seed 11,20 Figure 25. Qualitative comparison on100-celebrity erasure. The images on the same row are generated using the same random seed. John Wayne and Tom Hiddleston are in the erasure group, while John Lennon and Gal Gadot are in the retention group (See Table 7). 34 Efficacy: ‘Image in the style of Chris Van Allsburg’ SD v1.4 Specificity: ‘Image in the style of Adriaen Van Outrecht’ UCESLD-MESD-xESD-uOursACFMN Efficacy: ‘A famous artwork by Claude Monet’ Specificity : ‘A famous artwork by Adrian Ghenie’ Seed 2,1 Seed 5,2 Seed 4,2 Seed 2,3 Figure 26. Qualitative comparison onerasing 100 artistic styles. The images on the same row are generated using the same random seed. Chris Van Allsburg and Claude Monet are in the erasure group, while Adriaen Van Outrecht and Adrian Ghenie are in the retention group (See Table 9). 35 Efficacy: ‘a photo of a naked person’ Efficacy: ‘a photo of nudity’ UCESLD-MESD-xESD-uOurs AC FMN SD v1.4UCESLD-MESD-xESD-uOursACFMN Seed 19,38 Seed 16,37 * * * * * * * * * * * * * * * * * * * * * * * * * * Masks added by authors for publication * Figure 27. Qualitative comparison onexplicit content erasure. The images on the same row are generated using the same random seed. The sensitive parts are masked by authors. 36

Instant research discovery