OrthoEraser: Coupled-Neuron Orthogonal Projection for Concept Erasure
Authors: Chuancheng Shi, Wenhua Wu, Fei Shen, Xiaogang Zhu, Kun Hu, Zhiyong Wang
Organizations: University of Sydney Sydney, Australia · National University of Singapore Singapore, Singapore · Adelaide University Adelaide, Australia · Edith Cowan University Perth, Australia
Text-to-image (T2I) models face significant safety risks from adversarial induction, yet current concept erasure methods often cause collateral damage to benign attributes when suppressing selected neurons entirely. This occurs because sensitive and benign semantics exhibit non-orthogonal superposition, sharing activation subspaces where their respective vectors are inherently entangled. To address this issue, we propose OrthoEraser, which leverages sparse autoencoders (SAE) to achieve high-resolution feature disentanglement and subsequently redefines erasure as an analytical orthogonalization projection that preserves the benign manifold's invariance. OrthoEraser first employs SAE to decompose dense activations and segregate sensitive neurons. It then uses coupled neuron detection to identify non-sensitive features vulnerable to intervention. The key novelty lies in an analytical gradient orthogonalization strategy that projects erasure vectors onto the null space of the coupled neurons. This orthogonally decouples the sensitive concepts from the identified critical benign subspace, effectively preserving non-sensitive semantics. Experimental results on safety demonstrate that OrthoEraser achieves high erasure precision, effectively removing harmful content while preserving the integrity of the generative manifold, and significantly outperforming SOTA baselines. This paper contains results of unsafe models.
Figures & tables
Figure 1: Comparison of concept erasure strategies between (a) existing methods and (b) our method, OrthoEraser. (a) Existing methods typically treat sensitive concepts as spatially isolated. (b) OrthoEraser decouples entangled features via gradient orthogonalization, selectively removing sensitive components to preserve non-sensitive generation capabilities.
Figure 2: Overall framework of our proposed OrthoEraser, which consists of three key components: (i) sensitive neuron detection with sparse autoencoders (SAE) [ 12 ] , (ii) coupled neuron detection via zero-ablation, and (iii) sensitive information suppression with gradient orthogonalization which projects intervention vectors onto the null space of these coupled neurons, ensuring precise concept erasure.
Figure 3: Layer-wise Localization and Sensitive Neuron Identification. (Left) sensitive score (SS) distribution across layers used to identify target sensitive layers. (Right) ΔWFS values of the top-50 neurons in sensitive layers, representing the core feature units contributing to the sensitive concept in the SAE space.
Number of nudity detected on I2P (Detected Quantity)
COCO
Method
Breast(F)
Genitalia(F)
Breast(M)
Genitalia(M)
Buttocks
Feet
Belly
Armpits
Total ↓
CS ↑
FID ↓
SD1.4 [ 1 ]
183
21
46
10
44
42
171
129
646
31.34
–
ESD [ 9 ]
14 (-169)
1 (-20)
8 (-38)
5 (-5)
5 (-39)
24 (-18)
31 (-140)
33 (-96)
121 (-525)
30.90 (-0.44)
16.88
UCE [ 10 ]
31 (-152)
6 (-15)
19 (-27)
8 (-2)
11 (-33)
20 (-22)
55 (-116)
36 (-93)
186 (-460)
29.92 (-1.42)
22.87
CA [ 39 ]
6 (-177)
1 (-20)
9 (-37)
10 (0)
4 (-40)
14 (-28)
28 (-143)
23 (-106)
95 (-551)
31.21 (-0.13)
21.55
SLD-Med [ 40 ]
47 (-136)
72 (+51)
3 (-43)
21 (+11)
39 (-5)
1 (-41)
26 (-145)
3 (-126)
212 (-434)
30.65 (-0.69)
19.53
Table 1: Comparison of nudity detection performance using NudeNet on I2P and content preservation on MS COCO. F: Female. M: Male. The underline represents the 2nd place.
Figure 4: Qualitative comparison with SOTA methods. Qualitative comparison of various safety guidance methods on the I2P dataset.
Strategy
Layer Index
I2P Detections ( ↓ )
SD1.4 (Baseline)
–
646
Similar Sensitive Score Layer
9
17 (−629)
First Sensitivity Peak Layer
3
24 (−632)
Global Optimal Layer (Ours)
10
5 (−641)
Table 2: Layer-wise ablation. Impact of layer selection on nudity detection performance on the I2P dataset. Values in parentheses denote the increase in detections relative to the optimal layer.
Figure 7Table 8
Figure 7: Visualizing feature entanglement. We visualize the distribution of neuron activation shifts ( Δactivation ) across three categories.
Standard Safety (%)
Adversarial Robustness (%)
Method
I2P Violence ↓
P4D ↓
Ring-A-Bell ↓
SD 1.4 [ 1 ]
40.1
98.7
83.1
ESD [ 9 ]
16.7 (-23.4)
63.3 (-35.4)
69.7 (-13.4)
UCE [ 10 ]
23.3 (-16.8)
80.2 (-18.5)
33.1 (-50.0)
SLD-Med [ 40 ]
19.7 (-20.4)
77.5 (-21.2)
66.2 (-16.9)
RECE [ 42 ]
14.2 (-25.9)
64.7 (-34.0)
13.4 (-69.7)
Table 5: Quantitative evaluation of generalization (I2P-Violence) and adversarial robustness (Ring-A-Bell, P4D). Best results are highlighted in bold .
Figure 8: Qualitative results on the MS COCO. We compare the image generation performance of OrthoEraser with other baseline methods using normal prompts.
Figure 9: Visualizing precision via residuals. The heatmaps illustrate the intensity of pixel shifts during the concept erasure process for both safe prompts (Top) and sensitive prompts (Bottom).
Figure 10: Visual ablation of scaling factor λ . We illustrate the impact of varying the path-level suppression factor λ .
Figure 11: Cross-Model Universality. The left panel shows the number of detected instances for specific body parts, while the right panel evaluates whether the model’s general capabilities degrade after neuron correction.
With the advance of generative AI, the text-to-image (T2I) model has the ability to generate various contents. However, T2I models still can generate unsafe contents. To alleviate this issue, various concept erasing methods are proposed. However, existing methods tend to excessively erase unsafe concepts and suppress benign concepts contained in harmful prompts, which can negatively affect model utility. In this paper, we focus on eliminating unsafe content while maintaining model capability in safe semantic meaning interpretation by optimizing the concept erasing reward (CER) with reinforcement learning. To avoid overly content erasure, we introduce the Safe Adapter to project partial text embedding for efficient concept regulation in cross-attention layers. Extensive experiments conducted on different datasets demonstrate the effectiveness of the proposed method in alleviating unsafe content generation while preserving the high fidelity of benign images compared with existing state-of-the-art (SOTA) concept erasing methods. In terms of robustness, our method outperforms counterparts against red-teaming tools. Moreover, we showcase the proposed approach is more effective in emerging image-to-image (I2I) scenarios compared with others. Lastly, we extend our method to erase general concepts, such as artistic styles and objects. Disclaimer: This paper includes discussions of sexually explicit content that may be offensive to certain readers. All images used in this work are synthesized or from public datasets.
Dong Han, Yong Li
Huawei Heisenberg Research Center, Huawei Technologies Düsseldorf GmbH, Düsseldorf, Germany · Computer Vison Group, Friedrich Schiller University Jena, Jena, Germany.
Text-to-image generative models have achieved impressive fidelity and diversity, but can inadvertently produce unsafe or undesirable content due to implicit biases embedded in large-scale training datasets. Existing concept erasure methods, whether text-only or image-assisted, face trade-offs: textual approaches often fail to fully suppress concepts, while naive image-guided methods risk over-erasing unrelated content. We propose TICoE, a text-image Collaborative Erasing framework that achieves precise and faithful concept removal through a continuous convex concept manifold and hierarchical visual representation learning. TICoE precisely removes target concepts while preserving unrelated semantic and visual content. To objectively assess the quality of erasure, we further introduce a fidelity-oriented evaluation strategy that measures post-erasure usability. Experiments on multiple benchmarks show that TICoE surpasses prior methods in concept removal precision and content fidelity, enabling safer, more controllable text-to-image generation. Our code is available at https://github.com/OpenAscent-L/TICoE.git
Jun Li, Lizhi Xiong, Ziqiang Li +4
Nanjing University of Information Science and Technology · Southeast University · Nanjing University of Science and Technology
Text-to-image (T2I) diffusion models inevitably internalize sensitive or non-compliant concepts from large-scale pretraining data, necessitating post-hoc concept erasure. However, existing erasure methods often lack explicit constraints on parameter updates, leading to over-intervention and unintended semantic drift. In addition, many methods rely on manually crafted counterfactual supervision, such as surrogate prompts, which incurs substantial data construction costs that limit scalability to new concepts. To address these limitations, we propose GRACE, a structured concept erasure framework designed to enable localized and selective intervention. Specifically, we introduce a semantically weighted sensitive subspace estimation to precisely lock intervention directions, and employ lightweight subspace-constrained adapters to prevent global semantic disturbance. To eliminate the dependency on manual prompt engineering, we design an automatically decoupled safe-anchor mechanism. To mitigate semantic drift induced by excessive intervention, we introduce an energy-driven dynamic gating mechanism that adaptively controls the timing and strength of intervention at inference. Extensive experiments demonstrate that our method achieves a superior balance between erasure effectiveness and generation fidelity. Compared with the average performance of five state-of-the-art (SOTA) concept erasure methods, our method improves the fine-grained NSFW reduction rate by 17.86%, while reducing the macro-averaged target CLIP Score and preservation-oriented Fréchet Inception Distance (FID) by 4.75% and 50.58%, respectively, indicating stronger concept suppression with substantially improved preservation of the original model's generative utility.
Qinghui Gong, Yihuai Liang, Yuanlun Xie +3
School of Information Science and Technology, Southwest Jiaotong University, Chengdu 611756, China · School of Electronic Information and Electrical Engineering, Chengdu University, Chengdu, China · Key Laboratory of Intelligent Control and Optimization for Industrial Equipment of Ministry of Education, Dalian University of Technology, Dalian, China +1