Paper deep dive
No Concept Escapes the Audit: Auditing-Aware Unlearning for Verifiable Concept Erasure in Diffusion Models
Kaiyuan Deng, Yuchen Li, Gen Li, Yang Xiao, Geng Yuan, Xiaoyong Yuan, Bo Hui, Xiaolong Ma
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Text-to-image diffusion models can generate prohibited content, which motivates concept erasure through machine unlearning. Most erasure methods intervene at the text interface, through prompt modification or localized updates to text-conditioning weights, and they are evaluated by what the model outputs for given prompts. Such evaluation cannot see what the network still encodes. Latent-space auditing, which bypasses text conditioning and probes the denoising network directly, shows that erased concepts remain recoverable from internal representations. We find that this also holds for methods built to be robust against adversarial prompts, and that the problem grows with the number of erased concepts. We propose Auditing-Aware Unlearning for Verifiable Concept Erasure in Diffusion Models (AVCE), a framework that grounds erasure in the model's latent representations. AVCE audits the embedding neighborhood of each concept and condenses the discovered vulnerable directions into an anchor at the weakest geometric point. It edits cross-attention and self-attention projections in closed form at this anchor, then fine-tunes the two pathways with pathway-level auditing losses, using orthogonal gradient projection to consolidate multiple concepts. Experiments on SD v1.5, SDXL, and Flux 1.0 across object, explicit-content, and artistic-style unlearning show that AVCE reduces attack success rates by 5.07x and improves auditing scores by 3.84x over the strongest baseline, while preserving competitive generation quality.
Tags
Links
- Source: https://arxiv.org/abs/2610.05401v1
- Canonical: https://arxiv.org/abs/2610.05401v1
Trouble viewing inline? Open PDF directly →
Full Text
74,173 characters extracted from source content.
Expand or collapse full text
No Concept Escapes the Audit: Auditing-Aware Unlearning for Verifiable Concept Erasure in Diffusion Models Kaiyuan Deng Yuchen Li Gen Li Affiliation: Clemson University Yang Xiao Affiliation: The University of Tulsa Geng Yuan Xiaoyong Yuan Bo Hui Xiaolong Ma Email: kaiyuan0415@arizona.edu*Equal contribution†Corresponding author Affiliation: Clemson University Affiliation: The University of Tulsa Affiliation: University of Georgia Affiliation: The University of Arizona Affiliation: Peking University Abstract Text-to-image diffusion models can generate prohibited content, which motivates concept erasure through machine unlearning. Most erasure methods intervene at the text interface, through prompt modification or localized updates to text-conditioning weights, and they are evaluated by what the model outputs for given prompts. Such evaluation cannot see what the network still encodes. Latent-space auditing, which bypasses text conditioning and probes the denoising network directly, shows that erased concepts remain recoverable from internal representations. We find that this also holds for methods built to be robust against adversarial prompts, and that the problem grows with the number of erased concepts. We propose Auditing-Aware Unlearning for Verifiable Concept Erasure in Diffusion Models (AVCE), a framework that grounds erasure in the model’s latent representations. AVCE audits the embedding neighborhood of each concept and condenses the discovered vulnerable directions into an anchor at the weakest geometric point. It edits cross-attention and self-attention projections in closed form at this anchor, then fine-tunes the two pathways with pathway-level auditing losses, using orthogonal gradient projection to consolidate multiple concepts. Experiments on SD v1.5, SDXL, and Flux 1.0 across object, explicit-content, and artistic-style unlearning show that AVCE reduces attack success rates by 5.07× 5.07× and improves auditing scores by 3.84× 3.84× over the strongest baseline, while preserving competitive generation quality. 1 Introduction Text-to-image (T2I) diffusion models generate diverse, high-fidelity images from natural language descriptions (Rombach et al., 2022; Ma et al., 2024; Podell et al., 2023; Saharia et al., 2022; Nichol et al., 2021; Ding et al., 2022; Zhou et al., 2022). Their wide deployment also raises ethical and legal risks, including copyright infringement, unauthorized trademark generation, and the synthesis of malicious imagery (Kazerouni et al., 2022; Xing et al., 2024; Jang et al., 2022; Wang et al., 2024; Nguyen et al., 2022; Weidinger et al., 2021; Brundage et al., 2018; Tolosana et al., 2020; Solaiman and Dennison, 2021). Machine unlearning (MU) addresses these risks by removing specific knowledge from a trained model without retraining it from scratch (Bourtoule et al., 2021; Guo et al., 2019; Graves et al., 2021; Xu et al., 2024; Marino et al., 2025; Zhang et al., 2023; Tu et al., 2025; Feng et al., 2025). In T2I generation, MU takes the form of concept erasure: the mapping between text prompts and a target visual concept is severed so that the model no longer renders the concept. Existing methods erase individual objects, styles, or identities (Jia et al., 2023; Kumari et al., 2023; Chavhan et al., 2024; Gandikota et al., 2023; Zhang et al., 2024a; Schramowski et al., 2023; Fan et al., 2023; Heng and Soh, 2023), and recent work extends erasure to multiple concepts at once (Lu et al., 2024; Lyu et al., 2024; Li et al., 2025b; Gandikota et al., 2024; Gong et al., 2024; Deng et al., 2026). Whether an erased concept has actually been removed is usually judged from model outputs. Benchmarks (Moon et al., 2025; Zhang et al., 2024b) score the images generated for a set of prompts, and adversarial evaluations (Zhang et al., 2024d; Chin et al., 2023; Pham et al., 2023; Tsai et al., 2023) search for prompts or embeddings that make the concept reappear. In response to these attacks, robust erasure methods harden the text-to-image mapping through adversarial training (Kim et al., 2024; Zhang et al., 2024c), erasure guided by inverted worst-case embeddings (Li et al., 2026; Srivatsan et al., 2025), or closed-form re-erasure of adversarial embeddings (Gong et al., 2024). These defenses bring attack success rates below those of non-robust baselines (Fig. 1, left). Low attack success, however, does not establish that the concept is gone. The latent-space audit of Sharma et al. (2024) bypasses text conditioning altogether: it injects a concept-informative latent code at an intermediate denoising step (partial diffusion) and measures, through the Concept Retrieval Score (CRS) and the Concept Confidence Score (CCS), whether the unlearned model still reconstructs the concept (Appendix A.2). Under this audit, methods that block adversarial prompts still retain the concept in their internal representations (Fig. 1, middle and right; Section 4). The cause is structural. These methods act mainly on the text encoder or on the cross-attention projections: the key and value projections of the cross-attention layers hold 2.23% of the UNet parameters in SD v1.5 and 13.27% in SDXL. Such edits sever the pathway from text to concept and leave intact the capacity of the denoising network to reconstruct concept-related patterns, which is the capacity that partial diffusion probes. Attack robustness therefore shows only that the evaluated attacks fail to recover the erased concept; it does not establish that concept information has been removed from the learned representations. The discrepancy widens in multi-concept unlearning, where existing methods degrade as the number of erased concepts grows. We therefore design erasure around the audit rather than around the attack surface, and propose Auditing-Aware Unlearning for Verifiable Concept Erasure in Diffusion Models (AVCE), a framework that removes a concept from both the text-conditioning pathway and the visual pathway of the denoising network. AVCE proceeds in three stages. It first searches the embedding neighborhood of each concept for directions along which the concept can be revived, and condenses them into a Verifiable Vulnerability Anchor located at the weakest point of that neighborhood. It then performs Analytical Editing at this anchor: a closed-form rewrite of the cross-attention projections severs the association between text and concept, and a closed-form shrinkage of the self-attention projections suppresses the residual visual patterns of the concept. Finally, Audit-Guided Refinement fine-tunes the two pathways in alternation with pathway-level auditing losses that remove the non-linear leakage left by the linear edits, and applies orthogonal gradient projection so that multiple concepts can be erased within one model. Our contributions are as follows: ∙ The Illusion of Robustness. We apply latent-space auditing to robust concept erasure methods and show that blocking adversarial prompts does not remove the concept: once text conditioning is bypassed, its visual features remain recoverable from the internal representations of the model. ∙ Auditing-Aware Verifiable Concept Erasure. We propose AVCE, which moves erasure from the text-conditioning interface to the internal representations of the model. AVCE combines a Verifiable Vulnerability Anchor obtained by auditing the embedding space, closed-form editing of both cross-attention and self-attention projections, and fine-tuning with pathway-level auditing losses. ∙ Scalable Multi-Concept Erasure. AVCE handles inter-concept interference with difficulty-aware sampling and orthogonal gradient projection. On SD v1.5, SDXL, and Flux 1.0, AVCE reduces attack success rates by 5.07× 5.07× and improves auditing scores by 3.84× 3.84× over the strongest baseline. Figure 1: The illusion of robustness on SD v1.5 (erasing the concept “golf ball”). Robust methods block adversarial text inputs (left), yet latent-space auditing, which bypasses text conditioning, shows that the visual features of the target concept remain in the model (middle, right). 2 Related Work Concept unlearning in diffusion models. Existing methods fall into three groups. Training-based methods, such as ESD (Gandikota et al., 2023), FMN (Zhang et al., 2024a), SA (Heng and Soh, 2023), AC (Kumari et al., 2023), SalUn (Fan et al., 2023), and FADE (Thakral et al., 2025), fine-tune model weights to remove a concept through negative guidance or distribution alignment. Training-free methods such as ConceptPrune (Chavhan et al., 2024) identify and prune the neurons responsible for a concept without further optimization. Guidance-based methods such as SLD (Schramowski et al., 2023) steer the sampling trajectory away from undesired content and leave the pretrained weights unchanged. Multi-concept erasure follows three directions. Fine-tuning approaches, including AGE (Bui et al., 2025), CoE (Li et al., 2025a), and Sculpting Memory (Li et al., 2025b), iteratively optimize model weights or masks to balance forgetting and preservation. Analytical methods such as UCE (Gandikota et al., 2024) and ScaPre (Deng et al., 2026) modify weight matrices in closed form. Adapter-based methods, including MACE (Lu et al., 2024), SPM (Lyu et al., 2024), and GLOCE (Lee et al., 2025), attach lightweight modules such as LoRAs or one-dimensional adapters that suppress target concepts while the backbone remains fixed. Robust unlearning. AdvUnlearn (Zhang et al., 2024c) integrates adversarial training into concept erasure to counter prompt attacks while preserving utility. RACE (Kim et al., 2024) mitigates adversarial text embeddings with an efficient single-timestep adversarial training scheme. STEREO (Srivatsan et al., 2025) first identifies vulnerable embeddings and then performs anchor-guided erasure to resist embedding-space inversion. RECE (Gong et al., 2024) iterates closed-form solutions for rapid and robust alignment without extensive fine-tuning. AEGIS (Li et al., 2026) addresses the trade-off between robustness and retention in data-free settings through target-guided erasure and gradient synergy. AVCE differs from these methods in where it intervenes: it edits self-attention projections in addition to cross-attention projections, and it uses pathway-level auditing signals during fine-tuning. Evaluating concept erasure. Erasure is evaluated at three levels. Output-level benchmarks (Moon et al., 2025; Zhang et al., 2024b) score the images generated for fixed prompt sets with concept-specific classifiers. Attack-level evaluations search the text interface for inputs that revive the concept, through genetic search over discrete tokens (Tsai et al., 2023), optimization of token perturbations against the diffusion objective (Zhang et al., 2024d; Chin et al., 2023), or direct inversion of the erased embedding (Pham et al., 2023). Both levels observe the model only through its text interface. Representation-level auditing instead bypasses that interface: the partial-diffusion protocol of Sharma et al. (2024) injects a concept-informative latent at an intermediate denoising step and measures, through CRS and CCS, whether the unlearned network still reconstructs the concept. We adopt this protocol as our primary evaluation and, unlike prior work, also use its signal inside the erasure procedure. 3 Method Fig. 2 gives an overview of AVCE. The framework has three stages. We first audit the embedding neighborhood of each target concept and construct a Verifiable Vulnerability Anchor (Section 3.1). We then edit the cross-attention and self-attention projections in closed form at this anchor (Section 3.2). Finally, we fine-tune the edited model with pathway-level auditing losses and consolidate multiple concepts through orthogonal gradient projection (Section 3.3). Figure 2: Overview of the AVCE framework. The Verifiable Vulnerability Anchor is obtained by auditing the embedding space for its weakest geometric point. Analytical Editing rewrites cross-attention via a Semantic Modulator and shrinks self-attention via a Visual Localizer. Audit-Guided Refinement closes residual leakage through pathway-level fine-tuning with multi-concept gradient consolidation. 3.1 Verifiable Vulnerability Anchor Existing unlearning methods apply erasure at the original prompt embedding and leave robustness to separate, post-hoc defenses. The neighborhood of that embedding, however, may contain directions along which the erased concept can be revived. We therefore audit this neighborhood before editing and replace the original embedding with an anchor that summarizes the vulnerable directions found. For a set of N target concepts ii=1N\C_i\_i=1^N, let co,i∈ℝdinc_o,i ^d_in be the original text embedding of the i-th concept. We optimize probe embeddings ca,ic_a,i that reproduce the generative behavior of iC_i while lying far from co,ic_o,i. A search through the full denoising network alone tends to return embeddings that revive the concept by re-routing the attention maps of the cross-attention (CA) layers, that is, through prompt alignment, rather than through the visual content that the CA layers inject and the self-attention (SA) layers propagate. The auditing objective therefore also evaluates each candidate with the CA attention maps held fixed. To cover diverse vulnerable directions, we run K randomly initialized searches. The objective and the gradient update for the k-th search at iteration j are ℒaudit(c)= _audit(c)\;=\; zt,t[‖ϵθ,t(zt,c)−ϵθ,t(zt,co,i)‖22]−τ‖c−co,i‖2 _z_t,t [\| _θ,t(z_t,c)- _θ,t(z_t,c_o,i)\|_2^2 ]-τ\|c-c_o,i\|_2 +μzt,t[‖ϵ~θ,t(zt,c)−ϵ~θ,t(zt,co,i)‖22], +\;μ\,E_z_t,t [\| ε_θ,t(z_t,c)- ε_θ,t(z_t,c_o,i)\|_2^2 ], (1) ca,i,k(j+1)=ca,i,k(j)−β∇cℒaudit(ca,i,k(j)),c_a,i,k^(j+1)\;=\;c_a,i,k^(j)-β\, _cL_audit (c_a,i,k^(j) ), (2) where ztz_t is the noisy latent at timestep t, ϵθ,t _θ,t is the denoising network, ϵ~θ,t ε_θ,t denotes its variant in which every CA layer computes its attention maps from co,ic_o,i (keys from co,ic_o,i) and its values from the input condition c, so that ϵ~θ,t(zt,co,i)=ϵθ,t(zt,co,i) ε_θ,t(z_t,c_o,i)= _θ,t(z_t,c_o,i), τ>0τ>0 is the repulsion coefficient, μ≥0μ≥ 0 controls the auditing strength, and β is the step size. The first term favors embeddings whose full-network prediction matches that of the original concept. The second term pushes the search away from co,ic_o,i so that it reaches distant regions of the embedding space. The third term holds the attention maps at those of co,ic_o,i, so a candidate can reduce it only through the content it injects; it thereby penalizes candidates that revive the concept only through prompt alignment. A search counts as successful when its probe reproduces the noise prediction of the original concept substantially better than the null prompt does, which excludes probes that drifted into unrelated regions of the embedding space (Appendix A.4). From the successful searches ca,i,kk=1K\c_a,i,k\_k=1^K, we compute the perturbations δi,k=ca,i,k−co,i _i,k=c_a,i,k-c_o,i and stack them into a residual matrix Δi _i. The Verifiable Vulnerability Anchor ci⋆c_i places the largest perturbation magnitude along the principal direction ui,1u_i,1, the leading left singular vector of Δi _i, whose sign is fixed to agree with the mean perturbation: ci⋆=co,i+(maxk‖δi,k‖2)ui,1.c_i \;=\;c_o,i\;+\; ( _k\| _i,k\|_2 )\,u_i,1. (3) The anchor condenses the audited directions into a single point. All subsequent editing is applied at ci⋆c_i instead of co,ic_o,i, that is, at the weakest point found by the audit. 3.2 Analytical Editing for a Safer Model Space Given the anchor ci⋆c_i , we modify the model through two closed-form edits that act on disjoint parameter sets. The first rewrites the cross-attention projections to remove the association between text and concept. The second shrinks the self-attention projections to suppress the residual visual patterns of the concept. Both edits are computed in one shot. They already remove a large part of the concept (Section 4.5) and provide the initialization for the subsequent fine-tuning. 3.2.1 (I) Cross-Attention Analytical Erasure Cross-attention layers map text embeddings to visual features and are the main channel through which concept semantics enter generation. We rewrite their projections in closed form so that the concept association is removed while unrelated generative capabilities are preserved. Let Wca⋆∈ℝdout×dinW _ca ^d_out× d_in denote the edited weight for erasing N concepts. The erasure target is the unconditional response v=W0c∅v=W_0c_ , where W0W_0 is the original projection and c∅c_ is the end-of-text embedding of the null prompt; every erased concept is mapped to this same target. Semantic Modulator. To limit collateral damage, we select output channels according to statistical stability and information-theoretic discriminability. For a calibration set of P target-concept samples, let ai,r(p)a_i,r^(p) denote the activation of channel r on the p-th sample, with mean a¯i,r a_i,r and variance σi,r2 _i,r^2. We compute a Fisher-style stability score fi,r=a¯i,r2/(σi,r2+ε)f_i,r= a_i,r^2/( _i,r^2+ ) and the Symmetric Uncertainty mi,r=2I(qi,r,yi)/(H(qi,r)+H(yi)+ε)m_i,r=2\,I(q_i,r;y_i)/(H(q_i,r)+H(y_i)+ ), where qi,r=[ai,r>[ai,r]]q_i,r=1[a_i,r>E[a_i,r]] is a binary activation state, yi∈0,1y_i∈\0,1\ is the target-vs-neutral label, I(⋅,⋅)I(·;·) is mutual information, and H(⋅)H(·) is Shannon entropy. Temperature-scaled sigmoids map the two scores to bounded multipliers ρi,r,αi,r∈[0,1] _i,r, _i,r∈[0,1]. Their product gi,r=αi,r⋅ρi,rg_i,r= _i,r· _i,r forms a sparse vector gig_i that confines weight updates to robust semantic pathways. Analytical Erasure. We combine the output-side Semantic Modulator with an input-side constraint built from the perturbations collected during anchor construction. Stacking the perturbations of all successful searches, M≤NKM≤ NK in total, into Δ∈ℝdin×M ^d_in× M, the empirical covariance Ha=1MΔΔ⊤∈ℝdin×dinH_a= 1M ^d_in× d_in captures the principal vulnerable directions in embedding space. To keep the response to unrelated text unchanged, we also include a preservation set ℛR of token embeddings crc_r taken from neutral prompts, following UCE (Gandikota et al., 2024). We define the input geometry operator Q2Q_2 and the modulated target matrix Q1Q_1 as Q2=λI+∑i=1Nci⋆ci⋆⊤+ 2Ha+∑r∈ℛcrcr⊤∈ℝdin×din, Q_2\;=\;λ I\;+\; _i=1^Nc_i c_i \;+\;2H_a\;+\; _r c_rc_r \;∈\;R^d_in× d_in, (4) Q1=λW0+∑i=1NDiag(gi)vci⋆⊤+∑r∈ℛW0crcr⊤∈ℝdout×din, Q_1\;=\;λ W_0\;+\; _i=1^NDiag(g_i)\,v\,c_i \;+\; _r W_0\,c_rc_r \;∈\;R^d_out× d_in, (5) where λ>0λ>0 is the ridge coefficient. The edited weight is Wca⋆=Q1Q2−1.W _ca\;=\;Q_1Q_2^-1. (6) Because HaH_a inflates the eigenvalues of Q2Q_2 along vulnerable axes, Q2−1Q_2^-1 attenuates the response of Wca⋆W _ca to inputs along those directions, which limits how far an embedding in the audited neighborhood can reactivate the concept. The preservation terms keep Wca⋆crW _cac_r close to W0crW_0c_r: text embeddings share a large common component, and without these terms the attenuation along ci⋆c_i and the vulnerable directions also suppresses the response to unrelated prompts. 3.2.2 (I) Self-Attention Analytical Shrinkage Self-attention layers propagate and consolidate visual features across spatial positions and receive no direct text input. After the cross-attention edit, concept-specific spatial patterns remain in these layers and can still be exploited. We suppress them with a closed-form shrinkage: the patterns are first localized with the help of cross-attention, and the corresponding directions in the SA weight space are then shrunk. Visual Localizer. We use cross-attention as a semantic probe to locate concept-specific SA features. For a fixed noisy latent ztz_t at an intermediate timestep, we run two forward passes, one conditioned on concept iC_i and one unconditional. At each SA–CA layer pair ℓ , we record the SA input features Xℓ(cond),Xℓ(uncond)∈ℝL×dX_ ^(cond),X_ ^(uncond) ^L× d and the CA output features Yℓ(cond),Yℓ(uncond)∈ℝL×doutY_ ^(cond),Y_ ^(uncond) ^L× d_out, where L is the number of spatial tokens. The difference between the two CA outputs yields a normalized spatial mask wℓ,i(s)w_ ,i^(s), and the visual anchor v^ℓ,i v_ ,i is obtained by pooling the conditional SA input with this mask: wℓ,i(s)=‖Yℓ,s(cond)−Yℓ,s(uncond)‖2∑s′=1L‖Yℓ,s′(cond)−Yℓ,s′(uncond)‖2+ε,s=1,…,L, w_ ,i^(s)\;=\; \|Y_ ,s^(cond)-Y_ ,s^(uncond)\|_2 _s =1^L\|Y_ ,s ^(cond)-Y_ ,s ^(uncond)\|_2+ , s=1,…,L, (7) v^ℓ,i=∑s=1Lwℓ,i(s)Xℓ,s(cond)∈ℝd. v_ ,i\;=\; _s=1^Lw_ ,i^(s)\,X_ ,s^(cond)\;∈\;R^d. (8) The mask concentrates v^ℓ,i v_ ,i on the spatial positions where the text condition changes the CA output, that is, where the concept is rendered, and down-weights the background. Analytical Shrinkage. We stack the visual anchors into V^ℓ=[v^ℓ,1,…,v^ℓ,N]∈ℝd×N V_ =[ v_ ,1,…, v_ ,N] ^d× N and compute the empirical visual covariance Σsa,ℓ=1NV^ℓV^ℓ⊤ _sa, = 1N V_ V_ . The key and value projections are then shrunk from the right in closed form: Wsa⋆=Wsa(I+κΣsa,ℓ)−1,W _sa\;=\;W_sa (I+κ\, _sa, )^-1, (9) where κ≥0κ≥ 0 controls the shrinkage strength. The edit compresses representations along the concept-related visual axes and leaves orthogonal directions unchanged, at the cost of one d×d× d matrix inverse per layer. 3.3 Audit-Guided Refinement The analytical edits are linear, whereas the denoising network is deeply non-linear, so concept traces may persist in the interactions between layers. We therefore add a refinement phase that alternates between the two pathways and includes an auditing term in every update, so that concept removal is checked at the pathway level rather than at the output level. Let ϵs,t(c) _s,t(c) and ϵb,t(c) _b,t(c) denote the noise predictions of the student (edited) model and of the frozen base teacher at timestep t under text condition c. Let ϵs,t∖ca(c) _s,t (c) denote the student’s prediction with its cross-attention projections restored to the base weights. Since the student departs from the base model only in the edited attention projections, ϵs,t∖ca _s,t departs from the base prediction only through the self-attention pathway. For a target concept iC_i, we write coc_o and c⋆c for its original embedding co,ic_o,i and its anchor ci⋆c_i , dropping the index i, and ∅ for the null condition. Each iteration alternates between two pathway-specific updates. The first updates only the cross-attention parameters: ℒca=zt,t[‖ϵs,t(co)−ϵb,t(∅)‖22]+λcazt,t[‖ϵs,t(co)−ϵs,t∖ca(co)‖22].L_ca\;=\;E_z_t,t [\| _s,t(c_o)- _b,t( )\|_2^2 ]\;+\; _ca\,E_z_t,t [\| _s,t(c_o)- _s,t (c_o)\|_2^2 ]. (10) The first term moves the student’s output for the concept prompt toward the unconditional output of the base model. The second term audits whether the erasure originates from the cross-attention pathway. It measures the discrepancy between the full-model output and the output with cross-attention frozen, and thereby drives the contribution of cross-attention to concept generation toward zero instead of allowing self-attention to compensate. The second update modifies only the self-attention parameters: ℒsa=zt,t[‖ϵs,t∖ca(co)−ϵs,t∖ca(∅)‖22]+λsazt,t[‖ϵs,t∖ca(c⋆)−ϵs,t∖ca(∅)‖22].L_sa\;=\;E_z_t,t [\| _s,t (c_o)- _s,t ( )\|_2^2 ]\;+\; _sa\,E_z_t,t [\| _s,t (c )- _s,t ( )\|_2^2 ]. (11) Both terms are computed with cross-attention frozen, so their gradients are attributable to the self-attention pathway alone. The first term moves the internal visual response of the model to coc_o toward the unconditional response. The second term applies the same constraint at the anchor c⋆c (Section 3.1), which addresses the non-linear leakage along the direction that the closed-form edits are least likely to have covered. Retaining unrelated generation. The erasure targets in Eqs. (10) and (11) do not constrain the response to unrelated text, and fine-tuning against them alone degrades generation for other prompts. Each update therefore adds a retain term on neutral prompts cnc_n, drawn from the prompts that define the preservation set ℛR (Section 3.2.1): ℒca+=λrzt,t[∥ϵs,t(cn)−ϵb,t(cn)∥22],ℒsa+=λrzt,t[∥ϵs,t∖ca(cn)−ϵb,t(cn)∥22].L_ca += _r\,E_z_t,t [\| _s,t(c_n)- _b,t(c_n)\|_2^2 ], _sa += _r\,E_z_t,t [\| _s,t (c_n)- _b,t(c_n)\|_2^2 ]. (12) Scalable Multi-Concept Consolidation. When N concepts are erased simultaneously, interference between their gradients can destabilize training. For each concept i, we maintain an exponential moving average ℒ~i L_i of its ℒsaL_sa as a difficulty score, and we sample a mini-batch of B concepts at each iteration with probability pi= 0.8ℒ~i∑l=1Nℒ~l+0.2N,p_i\;=\;0.8\, L_i _l=1^N L_l\;+\; 0.2N, (13) which prioritizes harder concepts while keeping a uniform exploration floor. Let hih_i denote the gradient for sampled concept i. For each conflicting pair (hi⊤hj<0h_i h_j<0), we project hih_i onto the normal plane of hjh_j, following gradient surgery (Yu et al., 2020): hi⋆=hi−hi⊤hj‖hj‖22hj.h_i \;=\;h_i\;-\; h_i h_j\|h_j\|_2^2\,h_j. (14) The projection removes the component of hih_i that opposes hjh_j, so an update for one concept does not undo progress on another. 4 Experiment We evaluate AVCE on three concept unlearning tasks: multi-concept object unlearning (Section 4.2), explicit-content unlearning (Section 4.3), and artistic-style unlearning (Section 4.4), all under the protocol of Section 4.1. Section 4.5 presents ablation studies. Appendix B reports results on additional backbones (Tables 8, 9, 10), large-scale unlearning (Fig. 6), and runtime (Table 7). 4.1 Experimental Settings All experiments are primarily conducted on Stable Diffusion XL (SDXL) (Podell et al., 2023), with additional evaluations on Stable Diffusion v1.5 (SD v1.5) (Rombach et al., 2022) and Flux 1.0 (Labs, 2024). We compare AVCE against eight representative baselines: ESD (Gandikota et al., 2023), SPM (Lyu et al., 2024), MACE (Lu et al., 2024), SM (Li et al., 2025b), UCE (Gandikota et al., 2024), RECE (Gong et al., 2024), STEREO (Srivatsan et al., 2025), and AdvUnlearn (AdvU) (Zhang et al., 2024c). Multi-object unlearning is evaluated on Imagenette (Howard and others, 2019), a ten-class ImageNet subset. Explicit-content unlearning uses the I2P dataset (Schramowski et al., 2023). For artistic-style unlearning, we target five styles and follow prior settings (Chavhan et al., 2024; Deng et al., 2026). To evaluate attack success rate (ASR), we use concept-specific classifiers to detect whether erased concepts reappear in generated images: an ImageNet-pretrained ResNet50 for objects (Chavhan et al., 2024), NudeNet for explicit content (Bedapudi, 2019), and a ViT-base model fine-tuned on WikiArt for styles (Zhang et al., 2024d). We further assess robustness using Ring-A-Bell (Tsai et al., 2023) (ASR1), UnlearnDiffAtk (Zhang et al., 2024d) (ASR2), and P4D (Chin et al., 2023) (ASR3). We also adopt Concept Confidence Score (CCS) and Concept Retrieval Score (CRS) (Sharma et al., 2024) as auditing metrics to distinguish genuine erasure from latent-space concealment. We evaluate FID and CLIP score on COCO-30K, a 30K-caption subset of MS-COCO (Lin et al., 2014), to measure generative fidelity and text-image alignment after unlearning. AVCE is trained and evaluated on NVIDIA H100 (80 GB) GPUs. For reproducibility, all baseline results are obtained from official open-source implementations (Appendix C). 4.2 Object Unlearning Erasure effectiveness is measured by Unlearn Acc, the accuracy of a pretrained ResNet50 classifier in detecting the target objects in generated images. Table 1 shows that AVCE attains the lowest Unlearn Acc among the methods that remain usable, with CLIP and FID on COCO-30K comparable to those of the baselines. UCE and RECE also reach zero Unlearn Acc, but only because the edited model collapses (Fig. 3), which makes them unusable in this setting. Under the three attacks, AVCE reduces ASR by over 50 percentage points on average relative to the strongest baseline, STEREO. Fig. 3 shows that most baselines still generate recognizable target objects under adversarial prompts, whereas the outputs of AVCE no longer contain them. The auditing metrics separate the methods further. Every baseline has low CRS and high CCS, which indicates that the erased concepts remain in the latent space, while AVCE attains substantially higher CRS and lower CCS. Table 1: Quantitative results of multi-concept object unlearning on SDXL. Comparison of erasure accuracy, robustness, and generation quality across methods. For UCE and RECE the edited model collapses (Fig. 3), so attack and auditing metrics are not reported (–). Metric Method SDXL ESD SPM MACE SM UCE RECE STEREO AdvU AVCE Unlearn Acc (↓ ) 87.23 77.83 68.43 64.34 64.56 0 0 72.15 69.32 8.15 CLIP (↑ ) 31.62 31.45 31.53 31.26 31.24 22.34 22.17 30.67 30.42 30.58 FID (↓ ) 11.92 13.87 14.14 14.53 14.76 37.42 35.68 15.02 15.39 14.87 ASR1 (↓ ) 99.2 84.7 81.2 78.5 80.3 – – 68.2 69.7 14.5 ASR2 (↓ ) 97.6 88.3 85.6 82.1 84.8 – – 73.8 75.6 16.7 ASR3 (↓ ) 98.2 92.2 89.7 87.4 88.6 – – 80.4 81.3 17.2 CRS (↑ ) – 0.14 0.16 0.21 0.22 – – 0.20 0.26 0.82 CCS (↓ ) – 0.85 0.78 0.74 0.71 – – 0.62 0.69 0.18 Figure 3: Visual comparison of different methods for multi-concept unlearning on SDXL. 4.3 Explicit-Content Unlearning Table 2 reports per-category NudeNet detections on the I2P dataset. AVCE yields the lowest total count, with consistent reductions across body-part categories: total detections fall by over two-thirds relative to the next best baseline and by nearly 89% relative to the original SDXL. FID and CLIP remain comparable to those of baselines that retain substantially more explicit content (see also Fig. 4). Table 3 evaluates whether the erased content can be recovered by adversarial prompts, with “nudity” as the target concept. AVCE lowers ASR by over 50 percentage points on average relative to the strongest baseline, STEREO, across the three attacks. The auditing metrics show the same separation as in object unlearning: the baselines have low CRS and high CCS, whereas AVCE attains markedly higher CRS and lower CCS, which indicates removal at the representation level. Table 2: Per-category NudeNet detections on the I2P dataset for explicit-content unlearning on SDXL. “(F)” denotes female and “(M)” male. Method NudeNet Detection Metric Armpits Belly Buttocks Feet Breasts (F) Genitalia (F) Breasts (M) Genitalia (M) Total ↓ FID ↓ CLIP ↑ ESD 119 71 7 29 85 1 5 0 317 13.87 31.45 SPM 121 68 10 33 90 2 4 0 328 14.14 31.53 MACE 156 102 21 58 139 5 9 1 491 13.53 31.26 SM 115 74 9 35 92 1 6 0 332 13.76 31.24 UCE 117 70 13 41 107 1 5 0 354 14.23 31.32 RECE 89 52 6 25 68 1 3 0 244 15.12 31.07 STEREO 95 56 8 27 72 2 4 0 264 15.02 30.67 AdvU 91 49 5 23 65 1 2 0 236 15.39 30.42 AVCE 25 15 1 8 27 1 0 0 77 14.47 30.58 SDXL 198 143 38 87 185 12 28 3 694 11.92 31.62 Figure 4: Visual comparison of different methods for explicit-content unlearning on SDXL. Table 3: Quantitative results of explicit-content unlearning on SDXL. Comparison of robustness (ASR1/2/3) and auditing scores (CRS/CCS) across methods. Metric Method SDXL ESD SPM MACE SM UCE RECE STEREO AdvU AVCE ASR1 (↓ ) 98.4 81.3 78.5 75.2 77.1 80.8 71.6 64.7 66.3 11.8 ASR2 (↓ ) 96.8 85.6 82.4 79.3 81.5 84.7 76.1 70.2 72.4 13.5 ASR3 (↓ ) 97.5 89.4 86.8 84.1 85.7 88.6 83.2 77.1 78.5 14.6 CRS (↑ ) – 0.13 0.17 0.20 0.21 0.15 0.18 0.22 0.11 0.79 CCS (↓ ) – 0.87 0.81 0.76 0.73 0.84 0.70 0.65 0.72 0.21 4.4 Artistic-Style Unlearning We evaluate artistic-style unlearning with three CLIP-based metrics averaged over the five target styles. CLIPaCLIP_a measures text-image alignment on the erased style after unlearning (lower is better), CLIPcCLIP_c measures alignment on COCO-30K and reflects the preservation of unrelated concepts, and CLIPd=CLIPc−CLIPaCLIP_d=CLIP_c-CLIP_a summarizes erasure selectivity. In Table 4, AVCE attains the highest CLIPdCLIP_d by a large margin: it suppresses the target style while preserving alignment on unrelated concepts, and its FID is comparable to that of most baselines. Fig. 5 shows that the baselines retain visible stylistic traces of the target artist, whereas AVCE produces style-free and visually coherent images. AVCE also has the lowest ASR under all three attacks, more than 50 percentage points below the strongest baseline on average. In the audit, all baselines remain below 0.25 in CRS and at or above 0.60 in CCS, whereas AVCE attains markedly higher CRS and lower CCS. Figure 5: Artistic-style unlearning on SDXL. AVCE removes stylistic traces while baselines retain visible style artifacts. Table 4: Quantitative results of artistic-style unlearning on SDXL. Comparison of erasure effectiveness, robustness, and generation quality across methods. Metric Method SDXL ESD SPM MACE SM UCE RECE STEREO AdvU AVCE CLIPaCLIP_a (↓ ) 31.48 30.78 30.52 30.34 30.41 29.92 29.43 29.51 29.38 24.37 CLIPcCLIP_c (↑ ) 31.74 31.57 31.65 31.38 31.36 31.44 31.19 30.79 30.54 30.70 CLIPdCLIP_d (↑ ) 0.26 0.79 1.13 1.04 0.95 1.52 1.76 1.28 1.16 6.33 FID (↓ ) 11.78 13.62 14.32 14.81 14.52 14.08 13.94 15.28 15.63 14.72 ASR1 (↓ ) 98.7 81.4 78.3 75.6 77.2 80.5 71.9 65.3 66.8 11.2 ASR2 (↓ ) 97.1 85.8 82.7 79.4 81.6 85.2 76.3 70.6 72.5 13.4 ASR3 (↓ ) 97.8 89.6 87.1 84.5 86.2 88.9 83.4 77.5 78.8 14.8 CRS (↑ ) – 0.16 0.18 0.23 0.24 0.19 0.21 0.22 0.14 0.85 CCS (↓ ) – 0.83 0.76 0.72 0.69 0.80 0.65 0.60 0.67 0.15 4.5 Ablation Study We ablate the two design choices that define AVCE: the Verifiable Vulnerability Anchor, and the combination of analytical editing with audit-guided refinement. Effectiveness of the Verifiable Vulnerability Anchor. Most unlearning methods apply erasure at the original concept embedding coc_o. Table 6 shows that editing at coc_o leaves the model susceptible to adversarial prompts, with substantially higher ASR, and yields higher CCS and lower CRS, which indicates that the concept is concealed rather than removed. Replacing coc_o with the anchor c⋆c lowers ASR and CCS and raises CRS on all three tasks, while text-image alignment (CLIP) is essentially unchanged. Editing and Refinement. Table 6 compares Analytical Editing alone, Audit-Guided Refinement alone, and their combination. Editing alone preserves generation quality, as reflected in its CLIP scores, but traces that survive in non-linear interactions leave the model moderately vulnerable to attacks. Refinement alone, without the analytical initialization, also fails to remove the concept fully. The combination attains the lowest ASR and the best CCS and CRS on all three tasks while maintaining CLIP, which shows that the two stages are complementary. Table 5: Ablation study on the Verifiable Vulnerability Anchor: erasure at the original embedding coc_o versus at the anchor c⋆c . RAB, UD, and P4D denote Ring-A-Bell (ASR1), UnlearnDiffAtk (ASR2), and P4D (ASR3). Task Anchor ASR (%) ↓ CCS ↓ CRS ↑ CLIP ↑ P4D UD RAB Nudity coc_o 45.2 42.8 38.4 0.68 0.24 30.41 c⋆c 14.6 13.5 11.8 0.21 0.79 30.58 Van Gogh coc_o 48.3 45.1 41.2 0.62 0.28 30.75 c⋆c 14.8 13.4 11.2 0.15 0.85 30.70 Church coc_o 51.4 48.6 45.3 0.65 0.25 30.35 c⋆c 17.2 16.7 14.5 0.18 0.82 30.58 Table 6: Ablation study on the erasure stages: Analytical Editing only, Audit-Guided Refinement only, and both stages. Attack abbreviations as in Table 6. Task Phase ASR (%) ↓ CCS ↓ CRS ↑ CLIP ↑ P4D UD RAB Nudity Editing 38.5 35.2 31.6 0.45 0.42 30.52 Refinement 28.4 25.1 22.3 0.62 0.28 30.15 Both 14.6 13.5 11.8 0.21 0.79 30.58 Van Gogh Editing 41.2 38.5 35.4 0.40 0.48 30.62 Refinement 31.5 28.6 25.8 0.58 0.31 30.31 Both 14.8 13.4 11.2 0.15 0.85 30.70 Church Editing 44.6 41.2 38.7 0.42 0.45 30.71 Refinement 34.2 31.8 29.5 0.60 0.29 30.22 Both 17.2 16.7 14.5 0.18 0.82 30.58 5 Conclusion Robust concept erasure methods block adversarial prompts, yet latent-space auditing shows that the erased concept remains in the internal representations of the diffusion model. AVCE moves erasure from the text-conditioning interface to these representations. It audits the embedding neighborhood of each concept to build a Verifiable Vulnerability Anchor at the weakest geometric point, edits cross-attention and self-attention projections in closed form at this anchor, and then closes non-linear leakage with Audit-Guided Refinement, using orthogonal gradient projection to consolidate multiple concepts. Across three diffusion architectures and three unlearning tasks, AVCE lowers attack success rates and improves auditing scores over existing baselines while keeping generation quality competitive. These results indicate that erasure should be assessed and optimized at the level of what the model encodes, rather than only what it outputs for given prompts. What such an assessment can establish is bounded by the audit itself: our conclusions rest on one auditing protocol and three prompt-level attacks, and Appendix D states the assumptions this leaves open. Ethics Statement This work studies the removal of prohibited concepts, including explicit content, from text-to-image diffusion models, with the goal of safer model deployment. Explicit-content experiments use the public I2P prompt benchmark and the NudeNet detector solely to measure how much unsafe content remains after erasure. The adversarial attacks (Ring-A-Bell, UnlearnDiffAtk, P4D) and the latent-space auditing protocol are existing public methods, and we use them only to evaluate erased models. The study involves no human subjects and collects no new data. Reproducibility Statement Appendix A reports the attack configurations, the auditing protocol and its hyperparameters, the dataset construction for all three tasks, and the hyperparameters of every AVCE stage. Appendix C lists the official open-source implementations used for all baselines, attacks, and auditing metrics. Results on additional backbones, large-scale unlearning, and runtime are given in Appendix B. References Bedapudi (2019) P. Bedapudi NudeNet: an ensemble of neural nets for nudity detection and censoring. Note: Medium blog post Cited by: §A.1, §4.1. Bourtoule et al. (2021) L. Bourtoule, V. Chandrasekaran, C. A. Choquette-Choo, H. Jia, A. Travers, B. Zhang, D. Lie, and N. Papernot Machine unlearning. In 2021 IEEE symposium on security and privacy (SP), p. 141–159. Cited by: §1. Brundage et al. (2018) M. Brundage, S. Avin, J. Clark, H. Toner, P. Eckersley, B. Garfinkel, A. Dafoe, P. Scharre, T. Zeitzoff, B. Filar, et al. The malicious use of artificial intelligence: forecasting, prevention, and mitigation. arXiv preprint arXiv:1802.07228. Cited by: §1. Bui et al. (2025) A. Bui, T. Vu, L. Vuong, T. Le, P. Montague, T. Abraham, J. Kim, and D. Phung Fantastic targets for concept erasure in diffusion models and where to find them. arXiv preprint arXiv:2501.18950. Cited by: §2. Chavhan et al. (2024) R. Chavhan, D. Li, and T. Hospedales ConceptPrune: concept editing in diffusion models via skilled neuron pruning. arXiv preprint arXiv:2405.19237. Cited by: §A.1, §A.3, §A.3, §1, §2, §4.1. Chin et al. (2023) Z. Chin, C. Jiang, C. Huang, P. Chen, and W. Chiu Prompting4debugging: red-teaming text-to-image diffusion models by finding problematic prompts. arXiv preprint arXiv:2309.06135. Cited by: §A.1, §1, §2, §4.1. Deng et al. (2026) K. Deng, G. Li, Y. Xiao, B. Hui, and X. Ma Forget many, forget right: scalable and precise concept unlearning in diffusion models. arXiv preprint arXiv:2601.06162. Cited by: §A.3, §A.3, §A.3, §1, §2, §4.1. Ding et al. (2022) M. Ding, W. Zheng, W. Hong, and J. Tang Cogview2: faster and better text-to-image generation via hierarchical transformers. Advances in Neural Information Processing Systems 35, p. 16890–16902. Cited by: §1. Fan et al. (2023) C. Fan, J. Liu, Y. Zhang, E. Wong, D. Wei, and S. Liu Salun: empowering machine unlearning via gradient-based weight saliency in both image classification and generation. arXiv preprint arXiv:2310.12508. Cited by: §1, §2. Feng et al. (2025) Q. Feng, J. Tu, M. Kang, H. Zhao, C. Zhang, and H. Qian FG-oriu: towards better forgetting via feature-gradient orthogonality for incremental unlearning. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 1957–1967. Cited by: §1. Gandikota et al. (2023) R. Gandikota, J. Materzynska, J. Fiotto-Kaufman, and D. Bau Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 2426–2436. Cited by: §A.3, §A.3, §1, §2, §4.1. Gandikota et al. (2024) R. Gandikota, H. Orgad, Y. Belinkov, J. Materzyńska, and D. Bau Unified concept editing in diffusion models. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, p. 5111–5120. Cited by: §1, §2, §3.2.1, §4.1. Gong et al. (2024) C. Gong, K. Chen, Z. Wei, J. Chen, and Y. Jiang Reliable and efficient concept erasure of text-to-image diffusion models. In European Conference on Computer Vision, p. 73–88. Cited by: §A.1, §A.3, §1, §1, §2, §4.1. Graves et al. (2021) L. Graves, V. Nagisetty, and V. Ganesh Amnesiac machine learning. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 35, p. 11516–11524. Cited by: §1. Guo et al. (2019) C. Guo, T. Goldstein, A. Hannun, and L. Van Der Maaten Certified data removal from machine learning models. arXiv preprint arXiv:1911.03030. Cited by: §1. Heng and Soh (2023) A. Heng and H. Soh Selective amnesia: a continual learning approach to forgetting in deep generative models. Advances in Neural Information Processing Systems 36, p. 17170–17194. Cited by: §1, §2. Howard et al. (2019) J. Howard et al. Imagenette: a smaller subset of imagenet for quick experiments. Note: https://github.com/fastai/imagenette Cited by: §A.3, §4.1. Jang et al. (2022) J. Jang, D. Yoon, S. Yang, S. Cha, M. Lee, L. Logeswaran, and M. Seo Knowledge unlearning for mitigating privacy risks in language models. arXiv preprint arXiv:2210.01504. Cited by: §1. Jia et al. (2023) J. Jia, J. Liu, P. Ram, Y. Yao, G. Liu, Y. Liu, P. Sharma, and S. Liu Model sparsity can simplify machine unlearning. Advances in Neural Information Processing Systems 36, p. 51584–51605. Cited by: §1. Kazerouni et al. (2022) A. Kazerouni, E. K. Aghdam, M. Heidari, R. Azad, M. Fayyaz, I. Hacihaliloglu, and D. Merhof Diffusion models for medical image analysis: a comprehensive survey. arXiv preprint arXiv:2211.07804. Cited by: §1. Kim et al. (2024) C. Kim, K. Min, and Y. Yang Race: robust adversarial concept erasure for secure text-to-image diffusion model. In European Conference on Computer Vision, p. 461–478. Cited by: §1, §2. Kumari et al. (2023) N. Kumari, B. Zhang, S. Wang, E. Shechtman, R. Zhang, and J. Zhu Ablating concepts in text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 22691–22702. Cited by: §1, §2. Labs (2024) B. F. Labs Flux: advancing generative models for creative workflows. Note: https://huggingface.co/black-forest-labs/FLUX.1 Cited by: §4.1. Lee et al. (2025) B. H. Lee, S. Lim, and S. Y. Chun Localized concept erasure for text-to-image diffusion models using training-free gated low-rank adaptation. In Proceedings of the Computer Vision and Pattern Recognition Conference, p. 18596–18606. Cited by: §2. Li et al. (2025a) F. Li, Q. Xu, S. Bao, Z. Yang, X. Cao, and Q. Huang One image is worth a thousand words: a usability preservable text-image collaborative erasing framework. arXiv preprint arXiv:2505.11131. Cited by: §2. Li et al. (2026) F. Li, K. Li, Q. Wang, B. Han, and J. Zhou AEGIS: adversarial target-guided retention-data-free robust concept erasure from diffusion models. arXiv preprint arXiv:2602.06771. Cited by: §A.1, §A.1, §1, §2. Li et al. (2025b) G. Li, Y. Xiao, J. Ji, K. Deng, B. Hui, L. Guo, and X. Ma Sculpting memory: multi-concept forgetting in diffusion models via dynamic mask and concept-aware optimization. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 19659–19668. Cited by: §1, §2, §4.1. Lin et al. (2014) T. Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Dollár, and C. L. Zitnick Microsoft coco: common objects in context. In Computer vision–ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceedings, part v 13, p. 740–755. Cited by: §A.3, §4.1. Lu et al. (2024) S. Lu, Z. Wang, L. Li, Y. Liu, and A. W. Kong Mace: mass concept erasure in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 6430–6440. Cited by: §1, §2, §4.1. Lyu et al. (2024) M. Lyu, Y. Yang, H. Hong, H. Chen, X. Jin, Y. He, H. Xue, J. Han, and G. Ding One-dimensional adapter to rule them all: concepts diffusion models and erasing applications. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 7559–7568. Cited by: §1, §2, §4.1. Ma et al. (2024) N. Ma, M. Goldstein, M. S. Albergo, N. M. Boffi, E. Vanden-Eijnden, and S. Xie Sit: exploring flow and diffusion-based generative models with scalable interpolant transformers. In European Conference on Computer Vision, p. 23–40. Cited by: §1. Marino et al. (2025) B. Marino, M. Kurmanji, and N. D. Lane Bridge the gaps between machine unlearning and ai regulation. arXiv preprint arXiv:2502.12430. Cited by: §1. Moon et al. (2025) S. Moon, M. Lee, S. Park, and D. Kim Holistic unlearning benchmark: a multi-faceted evaluation for text-to-image diffusion model unlearning. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 16356–16366. Cited by: §1, §2. Nguyen et al. (2022) T. T. Nguyen, T. T. Huynh, Z. Ren, P. L. Nguyen, A. W. Liew, H. Yin, and Q. V. H. Nguyen A survey of machine unlearning. arXiv preprint arXiv:2209.02299. Cited by: §1. Nichol et al. (2021) A. Nichol, P. Dhariwal, A. Ramesh, P. Shyam, P. Mishkin, B. McGrew, I. Sutskever, and M. Chen Glide: towards photorealistic image generation and editing with text-guided diffusion models. arXiv preprint arXiv:2112.10741. Cited by: §1. Pham et al. (2023) M. Pham, K. O. Marshall, N. Cohen, G. Mittal, and C. Hegde Circumventing concept erasure methods for text-to-image generative models. arXiv preprint arXiv:2308.01508. Cited by: §1, §2. Podell et al. (2023) D. Podell, Z. English, K. Lacey, A. Blattmann, T. Dockhorn, J. Müller, J. Penna, and R. Rombach Sdxl: improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXiv:2307.01952. Cited by: §1, §4.1. Rombach et al. (2022) R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, p. 10684–10695. Cited by: §1, §4.1. Saharia et al. (2022) C. Saharia, W. Chan, S. Saxena, L. Li, J. Whang, E. L. Denton, K. Ghasemipour, R. Gontijo Lopes, B. Karagol Ayan, T. Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding. Advances in neural information processing systems 35, p. 36479–36494. Cited by: §1. Schramowski et al. (2023) P. Schramowski, M. Brack, B. Deiseroth, and K. Kersting Safe latent diffusion: mitigating inappropriate degeneration in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 22522–22531. Cited by: §A.3, §1, §2, §4.1. Sharma et al. (2024) A. S. Sharma, N. Sarkar, V. Chundawat, A. A. Mali, and M. Mandal Unlearning or concealment? a critical analysis and evaluation metrics for unlearning in diffusion models. arXiv preprint arXiv:2409.05668. Cited by: §A.2, §A.2, Appendix D, §1, §2, §4.1. Solaiman and Dennison (2021) I. Solaiman and C. Dennison Process for adapting language models to society (palms) with values-targeted datasets. Advances in Neural Information Processing Systems 34, p. 5861–5873. Cited by: §1. Srivatsan et al. (2025) K. Srivatsan, F. Shamshad, M. Naseer, V. M. Patel, and K. Nandakumar Stereo: a two-stage framework for adversarially robust concept erasing from text-to-image diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 23765–23774. Cited by: §A.1, §A.1, §A.3, §1, §2, §4.1. Thakral et al. (2025) K. Thakral, T. Glaser, T. Hassner, M. Vatsa, and R. Singh Fine-grained erasure in text-to-image diffusion-based foundation models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 9121–9130. Cited by: §2. Tolosana et al. (2020) R. Tolosana, R. Vera-Rodriguez, J. Fierrez, A. Morales, and J. Ortega-Garcia Deepfakes and beyond: a survey of face manipulation and fake detection. Information Fusion 64, p. 131–148. Cited by: §1. Tsai et al. (2023) Y. Tsai, C. Hsu, C. Xie, C. Lin, J. Chen, B. Li, P. Chen, C. Yu, and C. Huang Ring-a-bell! how reliable are concept removal methods for diffusion models?. arXiv preprint arXiv:2310.10012. Cited by: §A.1, §1, §2, §4.1. Tu et al. (2025) J. Tu, Q. Feng, C. Chen, J. Dong, H. Zhao, C. Zhang, and H. Qian CE-sdwv: effective and efficient concept erasure for text-to-image diffusion models via a semantic-driven word vocabulary. arXiv preprint arXiv:2501.15562. Cited by: §1. Wang et al. (2024) W. Wang, Z. Tian, C. Zhang, and S. Yu Machine unlearning: a comprehensive survey. arXiv preprint arXiv:2405.07406. Cited by: §1. Weidinger et al. (2021) L. Weidinger, J. Mellor, M. Rauh, C. Griffin, J. Uesato, P. Huang, M. Cheng, M. Glaese, B. Balle, A. Kasirzadeh, et al. Ethical and social risks of harm from language models. arXiv preprint arXiv:2112.04359. Cited by: §1. Xing et al. (2024) Z. Xing, Q. Feng, H. Chen, Q. Dai, H. Hu, H. Xu, Z. Wu, and Y. Jiang A survey on video diffusion models. ACM Computing Surveys 57 (2), p. 1–42. Cited by: §1. Xu et al. (2024) J. Xu, Z. Wu, C. Wang, and X. Jia Machine unlearning: solutions and challenges. IEEE Transactions on Emerging Topics in Computational Intelligence. Cited by: §1. Yu et al. (2020) T. Yu, S. Kumar, A. Gupta, S. Levine, K. Hausman, and C. Finn Gradient surgery for multi-task learning. In Advances in Neural Information Processing Systems, Vol. 33. Cited by: §3.3. Zhang et al. (2024a) G. Zhang, K. Wang, X. Xu, Z. Wang, and H. Shi Forget-me-not: learning to forget in text-to-image diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, p. 1755–1764. Cited by: §1, §2. Zhang et al. (2023) H. Zhang, T. Nakamura, T. Isohara, and K. Sakurai A review on machine unlearning. SN Computer Science 4 (4), p. 337. Cited by: §1. Zhang et al. (2024b) Y. Zhang, C. Fan, Y. Zhang, Y. Yao, J. Jia, J. Liu, G. Zhang, G. Liu, R. R. Kompella, X. Liu, et al. Unlearncanvas: stylized image dataset for enhanced machine unlearning evaluation in diffusion models. arXiv preprint arXiv:2402.11846. Cited by: §1, §2. Zhang et al. (2024c) Y. Zhang, X. Chen, J. Jia, Y. Zhang, C. Fan, J. Liu, M. Hong, K. Ding, and S. Liu Defensive unlearning with adversarial training for robust concept erasure in diffusion models. Advances in neural information processing systems 37, p. 36748–36776. Cited by: §A.1, §A.1, §A.3, §1, §2, §4.1. Zhang et al. (2024d) Y. Zhang, J. Jia, X. Chen, A. Chen, Y. Zhang, J. Liu, K. Ding, and S. Liu To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images… for now. In European Conference on Computer Vision, p. 385–403. Cited by: §A.1, §A.1, §1, §2, §4.1. Zhou et al. (2022) Y. Zhou, R. Zhang, C. Chen, C. Li, C. Tensmeyer, T. Yu, J. Gu, J. Xu, and T. Sun Towards language-free training for text-to-image generation. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, p. 17907–17917. Cited by: §1. Appendix A Detailed Settings This appendix provides implementation details: the adversarial attack configurations used for robustness evaluation (Appendix A.1), the latent-space auditing protocol (Appendix A.2), the dataset construction for all tasks (Appendix A.3), and the parameter settings of AVCE (Appendix A.4). A.1 Adversarial Attack Settings We evaluate robustness against three representative adversarial attacks spanning both white-box and black-box settings. Ring-A-Bell (ASR1) (Tsai et al., 2023). Ring-A-Bell is a black-box, model-agnostic attack that constructs adversarial prompts without direct access to the target model’s parameters. It first performs concept extraction by computing the mean embedding difference between prompts containing and lacking the target concept, forming an empirical concept representation. A genetic algorithm then optimizes discrete prompt tokens to maximize alignment with this representation. Following prior work (Zhang et al., 2024c; Srivatsan et al., 2025; Li et al., 2026), we set the weight of empirical concept to 3 and the prompt length to 16. For each evaluated model, one image is generated per adversarial prompt. UnlearnDiffAtk (ASR2) (Zhang et al., 2024d). UnlearnDiffAtk is a white-box attack that exploits the intrinsic classification capability of diffusion models to craft adversarial prompts. It optimizes discrete token perturbations via projection onto the probability simplex, without requiring an auxiliary reference model. Following the established protocol (Zhang et al., 2024c; Srivatsan et al., 2025; Gong et al., 2024; Li et al., 2026), we set the number of modifiable tokens to k=5k=5 for explicit-content unlearning and k=3k=3 for object and artistic-style unlearning. The perturbations are optimized across 50 diffusion timesteps for 40 iterations, using the AdamW optimizer with a learning rate of 0.01. P4D (ASR3) (Chin et al., 2023). Prompting4Debugging (P4D) is a white-box attack that optimizes adversarial prompts in the continuous embedding space and projects them back onto discrete tokens. It enforces similarity between noise predictions of the pre-trained and concept-erased models, effectively searching for prompts that bypass the erasure defense. We adopt the same configuration as UnlearnDiffAtk: k=5k=5 modifiable tokens for explicit-content unlearning and k=3k=3 for the other tasks, with 50 diffusion timesteps and 40 optimization iterations using AdamW at a learning rate of 0.01. Attack-Specific Classifiers. To determine attack success, we use the same concept-specific classifiers described in the main text (Section 4.1). For object unlearning, an ImageNet-pretrained ResNet50 (Chavhan et al., 2024) classifies generated images. For explicit content, NudeNet (Bedapudi, 2019) detects unsafe body-part categories; an image is deemed to contain inappropriate content if any of the following labels are detected: ANUS_EXPOSED, FEMALE_BREAST_EXPOSED, FEMALE_GENITALIA_EXPOSED, or MALE_GENITALIA_EXPOSED. For artistic-style unlearning, a ViT-base model fine-tuned on WikiArt (Zhang et al., 2024d) is used, with attack success determined by the top-1 prediction. A.2 Latent-Space Auditing Settings Beyond output-level adversarial evaluation, we employ the latent-space auditing framework proposed by Sharma et al. (2024) to assess whether unlearning methods achieve genuine concept erasure or merely suppress surface-level generation. Partial Diffusion Protocol. The core of the auditing framework is a partial diffusion pipeline that bypasses the text-conditioning pathway entirely. Given a fully trained model θ and an unlearned model θ∗θ^*, the procedure operates as follows: (1) A reference image xrefx_ref of the target concept is generated using the fully trained model θ with the concept prompt P. (2) The reference image is encoded into the latent space and noise is injected up to an intermediate timestep t=ψ⋅t=ψ·T, where ψ∈(0,1)ψ∈(0,1) is the partial diffusion ratio and T is the total number of timesteps. (3) The unlearned model θ∗θ^* then denoises this intermediate latent from timestep t back to t=0t=0, using a specified guidance scale η and an empty prompt (i.e., no text conditioning). This procedure injects concept-informative latent codes at intermediate denoising steps, probing whether the unlearned model’s deep parameters still retain the ability to reconstruct concept-related visual patterns. Evaluation Metrics. Two complementary metrics are computed from the partial diffusion outputs: • Concept Retrieval Score (CRS) measures the feature-level similarity between partially diffused outputs and the original concept domain. Specifically, CRS computes the cosine similarity in CLIP feature space between the output of the partial diffusion pipeline and the reference image. A higher CRS indicates that the concept’s visual features are more thoroughly removed from the model’s internal representations, meaning the unlearned model fails to reconstruct concept-related patterns even when provided with concept-informative latents. For genuinely unlearned models, CRS should be high (close to 1.0), reflecting that the model no longer encodes the target concept. • Concept Confidence Score (CCS) quantifies the confidence of a domain classifier in assigning the partially diffused output to the pre-unlearning concept domain. A lower CCS indicates that the model’s internal representations no longer encode concept-discriminative features. For genuinely unlearned models, CCS should be low (close to 0.0). Hyperparameters. Following the default settings in Sharma et al. (2024), we set the partial diffusion ratio to ψ=0.6ψ=0.6 and evaluate across a sweep of guidance scales η∈1,2,4,6,8,10η∈\1,2,4,6,8,10\. We report the CCS and CRS values averaged over the guidance sweep to ensure robustness of the evaluation. For each target concept, 50 reference images are generated from the fully trained model using distinct random seeds, and the metrics are averaged across all reference images. The DDIM scheduler with 50 inference steps is used for both the forward noise injection and the reverse denoising process. A.3 Dataset Construction We describe the datasets used for the three unlearning tasks, together with the extended benchmark for large-scale multi-concept evaluation. Object Unlearning. We evaluate multi-concept object unlearning on Imagenette (Howard and others, 2019), a ten-class subset of ImageNet containing easily recognizable categories: tench, English springer, cassette player, chain saw, church, French horn, garbage truck, gas pump, golf ball, and parachute. For each target class, we construct evaluation prompts using "a photo of a [class name]" and several variants such as "[class name] in a natural setting" and "a realistic image of [class name]". Following prior works (Gandikota et al., 2023; Chavhan et al., 2024; Deng et al., 2026), we generate 500 images per class with different random seeds to measure Unlearn Acc. Unlearn Acc is the top-1 accuracy of an ImageNet-pretrained ResNet50 on the images generated for the erased classes. Explicit Content Unlearning. We evaluate explicit-content unlearning on the I2P dataset (Schramowski et al., 2023), which contains prompts likely to induce unsafe generations, including nudity, violence, self-harm, and shocking imagery. Following prior works (Zhang et al., 2024c; Srivatsan et al., 2025; Gong et al., 2024), we focus on erasing nudity as a representative sensitive concept. For each model, we generate one image per prompt, yielding 4,703 images in total. NudeNet is applied with a threshold of 0.6 under the default I2P setting. Generation quality is further evaluated on COCO-30K (Lin et al., 2014) using FID and CLIP score. Artistic-Style Unlearning. For artistic-style unlearning, we follow the protocol of Chavhan et al. (2024); Deng et al. (2026); Gandikota et al. (2023) and erase five styles: Van Gogh, Pablo Picasso, Rembrandt, Andy Warhol, and Claude Monet. For each artist, 20 prompts are used to generate evaluation images, such as "A painting in the style of [artist name]" and "[subject] by [artist name]". We report three CLIP-based metrics: CLIPaCLIP_a for alignment with the erased style, CLIPcCLIP_c for generation quality on MS-COCO, and CLIPd=CLIPc−CLIPaCLIP_d=CLIP_c-CLIP_a as a measure of erasure selectivity averaged over the five target styles. Extended Benchmark for Large-Scale Unlearning. To assess scalability beyond standard benchmarks, we additionally use the extended dataset of Deng et al. (2026), which expands the forgetting scope to 5, 10, 15, and 20 concepts from a broader pool of ImageNet classes and artistic styles. Each scale includes standardized prompts, evaluation splits, and concept-specific classifiers, enabling controlled comparison as the number of erased concepts increases. We use this benchmark for the scalability study in Appendix B.1 (Fig. 6), which reports Unlearn Acc, ASR, CCS, and CRS against the number of forgotten concepts. A.4 Detailed Settings of AVCE Verifiable Vulnerability Anchor. For each target concept, we run K=10K=10 randomly initialized probe searches. Each search is optimized for 200 iterations with step size β=5×10−3β=5× 10^-3 using the Adam optimizer. The repulsion coefficient is set to τ=0.5τ=0.5, and the SA auditing strength to μ=0.3μ=0.3. Probe embeddings are initialized by adding Gaussian noise (0,0.12I)N(0,0.1^2I) to the original concept embedding co,ic_o,i. Timesteps t are sampled uniformly from 1,…,1000\1,…,1000\ at each iteration, and noisy latents ztz_t are constructed from a fixed set of 5 reference latent codes. After the search, each probe is tested over 4 fresh draws of (zt,t)(z_t,t): it is kept as successful if its noise-prediction error against the original-concept prediction is below half of the error obtained with the null prompt on the same draws; if no probe passes, the single best probe is kept. The principal direction ui,1u_i,1 is extracted via truncated SVD on the residual matrix Δi _i formed from the successful perturbations. Cross-Attention Analytical Erasure. The Semantic Modulator uses P=50P=50 calibration samples per concept, generated from the base model using diverse prompts. The Fisher stability score and Symmetric Uncertainty are computed with a temperature of σtemp=5.0 _temp=5.0 for the sigmoid mappings. The ridge coefficient is set to λ=0.1λ=0.1 for the closed-form solution W⋆=Q1Q2−1W =Q_1Q_2^-1. The preservation set ℛR contains the content-token and end-of-text embeddings of 50 neutral prompts describing everyday objects and scenes. The entire cross-attention editing is performed as a single one-shot matrix computation. Self-Attention Analytical Shrinkage. The Visual Localizer extracts concept-specific features using a mid-process noisy latent at timestep t=500t=500. The shrinkage coefficient is set to κ=1.0κ=1.0. Shrinkage is applied to all SA key and value projection matrices across all UNet layers simultaneously. Audit-Guided Refinement. The refinement phase alternates between CA and SA updates for 500 total iterations. We use the Adam optimizer with a learning rate of 1×10−51× 10^-5 and batch size of 1. The pathway-specific loss coefficients are set to λca=0.5 _ca=0.5 and λsa=0.5 _sa=0.5, and the retain coefficient to λr=10 _r=10; each update draws one neutral prompt at random. Timesteps are uniformly sampled at each iteration. For multi-concept consolidation, we use an EMA decay of 0.99 for the difficulty scores ℒ~i L_i and sample B=4B=4 concepts per mini-batch. Pairwise gradient conflicts are resolved via orthogonal projection following Eq. (14). Appendix B More Experimental Results B.1 Scalability of AVCE To evaluate scalability, we run object unlearning with an increasing number of forgotten concepts (N∈5,10,15,20N∈\5,10,15,20\). Figure 6 shows that the baselines degrade as N grows: Unlearn Acc, Attack Success Rate (ASR), and Concept Confidence Score (CCS) rise, and Concept Retrieval Score (CRS) falls, which indicates interference between concepts and a loss of robust erasure at scale. AVCE degrades far more slowly. With the erasure grounded in the Verifiable Vulnerability Anchor and gradient conflicts resolved during multi-concept consolidation, it maintains low Unlearn Acc, ASR, and CCS and a high CRS even when 20 objects are erased simultaneously. Computational overhead is a further concern in multi-concept unlearning. Sequential methods incur a training time that grows linearly with the number of target concepts ((N)O(N)). AVCE instead updates the model for all concepts concurrently through the consolidation strategy of Section 3.3. Table 7 reports the total unlearning time of AVCE for N∈1,3,5,10,20N∈\1,3,5,10,20\ on SD v1.5 and SDXL. Erasing a single concept takes approximately 6.02 minutes on SD v1.5 and 15.05 minutes on SDXL (measured on a single NVIDIA A100 GPU). Erasing 20 concepts simultaneously takes 6.74 and 16.86 minutes, respectively, an overhead of roughly 12%. B.2 Generalization Across Architectures and Tasks We further evaluate AVCE on two other diffusion architectures, SD v1.5 (Table 8) and Flux 1.0 (Table 9 and Table 10). Several baselines do not transfer across architectures. UCE, RECE, and SM achieve acceptable unlearning efficacy on SD v1.5 (Table 8; for example, 14.62% and 13.48% Unlearn Acc for UCE and RECE, respectively), but on the larger Flux 1.0 model their Unlearn Acc rises to around 75%–85% (Table 9). This suggests that existing closed-form and fine-tuning strategies have difficulty with the more entangled internal representations of newer, larger architectures. AVCE performs consistently across architectures. On SD v1.5 it reaches an Unlearn Acc of 4.15%. On Flux 1.0, where every baseline keeps Unlearn Acc above 75%, AVCE lowers Unlearn Acc to 16.32% and keeps ASR below 19%. Table 10 shows the same pattern for explicit-content unlearning on Flux 1.0: AVCE keeps ASR between 13.4% and 16.5% under the three attacks, whereas every baseline exceeds 80%. Table 7: Computational time (in minutes) of the proposed AVCE method across different numbers of concepts (N). Total time grows by approximately 12% from 1 to 20 concepts. Model Architecture Number of Forgotten Concepts (N) N=1N=1 N=3N=3 N=5N=5 N=10N=10 N=20N=20 SD v1.5 6.02 6.18 6.32 6.55 6.74 SDXL 15.05 15.45 15.78 16.35 16.86 Figure 6: Scalability analysis of multi-concept object unlearning. We report Unlearn Acc (↓ ), Attack Success Rate (↓ ), Concept Confidence Score (↓ ), and Concept Retrieval Score (↑ ) across varying numbers of forgotten concepts (N∈5,10,15,20N∈\5,10,15,20\). AVCE (red triangles) remains stable as N grows, whereas the baselines degrade. Table 8: Quantitative results of multi-concept object unlearning on SD v1.5. Comparison of erasure accuracy, robustness, and generation quality across methods. Metric Method SD v1.5 ESD SPM MACE SM UCE RECE STEREO AdvU AVCE Unlearn Acc (↓ ) 87.23 77.83 68.43 64.34 30.45 14.62 13.48 42.15 49.32 4.15 CLIP (↑ ) 31.62 31.45 31.53 31.26 31.24 30.95 31.12 30.67 30.42 30.58 FID (↓ ) 11.92 13.87 14.14 14.53 14.76 15.82 15.46 15.02 15.39 14.87 ASR1 (↓ ) 99.2 84.7 81.2 78.5 76.8 74.5 71.2 68.2 69.7 13.5 ASR2 (↓ ) 97.6 88.3 85.6 82.1 81.5 79.8 77.1 73.8 75.6 16.7 ASR3 (↓ ) 98.2 92.2 89.7 87.4 86.4 85.2 82.5 80.4 81.3 17.2 CRS (↑ ) – 0.14 0.16 0.21 0.38 0.35 0.42 0.20 0.32 0.82 CCS (↓ ) – 0.85 0.78 0.74 0.61 0.54 0.47 0.62 0.59 0.18 Table 9: Quantitative results of multi-concept object unlearning on Flux 1.0. Comparison of erasure accuracy, robustness, and generation quality across methods. Metric Method Flux ESD SPM MACE SM UCE RECE STEREO AdvU AVCE Unlearn Acc (↓ ) 89.45 86.24 83.51 79.82 81.25 77.43 75.68 82.35 80.54 16.32 CLIP (↑ ) 32.14 31.85 31.92 31.74 31.68 31.42 31.55 31.32 31.18 31.46 FID (↓ ) 11.05 12.95 13.24 13.58 13.72 14.85 14.52 14.15 14.36 13.92 ASR1 (↓ ) 99.5 92.1 89.4 85.2 87.6 84.3 81.7 79.5 80.1 15.2 ASR2 (↓ ) 98.7 94.5 91.8 88.6 90.1 87.9 85.4 83.2 84.8 17.4 ASR3 (↓ ) 99.1 96.3 94.2 92.1 93.4 91.5 88.6 87.4 88.2 18.6 CRS (↑ ) – 0.22 0.24 0.29 0.31 0.19 0.23 0.27 0.18 0.67 CCS (↓ ) – 0.76 0.72 0.68 0.65 0.74 0.70 0.63 0.67 0.29 Table 10: Quantitative results of explicit-content unlearning on Flux 1.0. Comparison of robustness (ASR1/2/3) and auditing scores (CRS/CCS) across methods. Metric Method Flux ESD SPM MACE SM UCE RECE STEREO AdvU AVCE ASR1 (↓ ) 99.2 93.5 90.2 86.4 88.1 85.3 82.6 80.2 81.5 13.4 ASR2 (↓ ) 98.5 95.8 92.7 89.5 91.2 88.6 86.3 84.1 85.7 15.1 ASR3 (↓ ) 98.9 97.4 95.1 92.8 94.3 92.4 90.5 88.7 89.4 16.5 CRS (↑ ) – 0.21 0.25 0.28 0.30 0.20 0.24 0.26 0.17 0.77 CCS (↓ ) – 0.78 0.74 0.69 0.67 0.75 0.72 0.65 0.68 0.22 Appendix C Code Reference To ensure fair and reproducible comparison, we evaluate our approach against the most comparable state-of-the-art unlearning and concept editing methods. Their official open-source implementations are listed below, and all baseline results in this paper are obtained using these repositories with recommended settings unless otherwise noted: Unlearn Methods • ESD: https://github.com/rohitgandikota/erasing • SPM: https://github.com/Con6924/SPM • MACE: https://github.com/Shilin-LU/MACE • UCE: https://github.com/rohitgandikota/unified-concept-editing • SM: https://github.com/coulsonlee/Sculpting-Memory-ICCV-2025 • RECE: https://github.com/CharlesGong12/RECE • AdvUnlearn: https://github.com/OPTML-Group/AdvUnlearn • STEREO: https://github.com/koushiksrivats/robust-concept-erasing Attack & Auditing Methods • CCS/CRS: https://github.com/respailab/unlearning-or-concealment • P4D: https://github.com/zhiyichin/P4D • Ring-A-Bell: https://github.com/chiayi-hsu/Ring-A-Bell • UnlearnDiffAtk: https://github.com/OPTML-Group/Diffusion-MU-Attack Appendix D Limitations Our audit relies on a single protocol, the partial-diffusion audit of Sharma et al. (2024) with its CRS and CCS metrics; other probes of internal representations may expose traces that this protocol does not. Robustness is measured against three prompt-level attacks (Ring-A-Bell, UnlearnDiffAtk, and P4D). We do not evaluate attacks that adapt to the anchor construction, nor recovery of an erased concept by fine-tuning the edited model. The analytical edits act on attention projections and assume white-box access to the model weights.