OrthoEraser: Coupled-Neuron Orthogonal Projection for Concept Erasure
Organizations: University of Sydney Sydney, Australia · National University of Singapore Singapore, Singapore · Adelaide University Adelaide, Australia · Edith Cowan University Perth, Australia
Abstract
Text-to-image (T2I) models face significant safety risks from adversarial induction, yet current concept erasure methods often cause collateral damage to benign attributes when suppressing selected neurons entirely. This occurs because sensitive and benign semantics exhibit non-orthogonal superposition, sharing activation subspaces where their respective vectors are inherently entangled. To address this issue, we propose OrthoEraser, which leverages sparse autoencoders (SAE) to achieve high-resolution feature disentanglement and subsequently redefines erasure as an analytical orthogonalization projection that preserves the benign manifold's invariance. OrthoEraser first employs SAE to decompose dense activations and segregate sensitive neurons. It then uses coupled neuron detection to identify non-sensitive features vulnerable to intervention. The key novelty lies in an analytical gradient orthogonalization strategy that projects erasure vectors onto the null space of the coupled neurons. This orthogonally decouples the sensitive concepts from the identified critical benign subspace, effectively preserving non-sensitive semantics. Experimental results on safety demonstrate that OrthoEraser achieves high erasure precision, effectively removing harmful content while preserving the integrity of the generative manifold, and significantly outperforming SOTA baselines. This paper contains results of unsafe models.
Figures & tables
| Number of nudity detected on I2P (Detected Quantity) | COCO | ||||||||||
| Method | Breast(F) | Genitalia(F) | Breast(M) | Genitalia(M) | Buttocks | Feet | Belly | Armpits | Total ↓ | CS ↑ | FID ↓ |
| SD1.4 [ 1 ] | 183 | 21 | 46 | 10 | 44 | 42 | 171 | 129 | 646 | 31.34 | – |
| ESD [ 9 ] | 14 (-169) | 1 (-20) | 8 (-38) | 5 (-5) | 5 (-39) | 24 (-18) | 31 (-140) | 33 (-96) | 121 (-525) | 30.90 (-0.44) | 16.88 |
| UCE [ 10 ] | 31 (-152) | 6 (-15) | 19 (-27) | 8 (-2) | 11 (-33) | 20 (-22) | 55 (-116) | 36 (-93) | 186 (-460) | 29.92 (-1.42) | 22.87 |
| CA [ 39 ] | 6 (-177) | 1 (-20) | 9 (-37) | 10 (0) | 4 (-40) | 14 (-28) | 28 (-143) | 23 (-106) | 95 (-551) | 31.21 (-0.13) | 21.55 |
| SLD-Med [ 40 ] | 47 (-136) | 72 (+51) | 3 (-43) | 21 (+11) | 39 (-5) | 1 (-41) | 26 (-145) | 3 (-126) | 212 (-434) | 30.65 (-0.69) | 19.53 |
| Strategy | Layer Index | I2P Detections ( ) |
|---|---|---|
| SD1.4 (Baseline) | – | 646 |
| Similar Sensitive Score Layer | 9 | 17 |
| First Sensitivity Peak Layer | 3 | 24 |
| Global Optimal Layer (Ours) | 10 | 5 |
| Standard Safety (%) | Adversarial Robustness (%) | ||
|---|---|---|---|
| Method | I2P Violence | P4D | Ring-A-Bell |
| SD 1.4 [ 1 ] | 40.1 | 98.7 | 83.1 |
| ESD [ 9 ] | 16.7 (-23.4) | 63.3 (-35.4) | 69.7 (-13.4) |
| UCE [ 10 ] | 23.3 (-16.8) | 80.2 (-18.5) | 33.1 (-50.0) |
| SLD-Med [ 40 ] | 19.7 (-20.4) | 77.5 (-21.2) | 66.2 (-16.9) |
| RECE [ 42 ] | 14.2 (-25.9) | 64.7 (-34.0) | 13.4 (-69.7) |
Safe T2I Generation
Safe text-to-image generation develops methods to prevent harmful images while preserving useful, faithful outputs.
See all 53 papers