Closed-Form Concept Erasure via Double Projections

Chi Zhang; Jingpu Cheng; Zhixian Wang; Ping Liu

cs.LGApr 11, 2026

Closed-Form Concept Erasure via Double Projections

Authors: Chi Zhang, Jingpu Cheng, Zhixian Wang, Ping Liu

Organizations: National University of Singapore · Shanghai Jiao Tong University · University of Nevada, Reno

Abstract

While modern generative models such as diffusion-based architectures have enabled impressive creative capabilities, they also raise important safety and ethical risks. These concerns have led to growing interest in concept erasure, the process of removing unwanted concepts from model representations. Existing approaches often achieve strong erasure performance but rely on iterative optimization and may inadvertently distort unrelated concepts. In this work, we present a simple yet principled alternative: a linear transformation framework that achieves concept erasure analytically, without any training. Our method adapts a pretrained model through two sequential, closed-form steps: first, computing a proxy projection of the target concept, and second, applying a constrained transformation within the left null space of known concept directions. This design yields a deterministic and geometrically interpretable procedure for safe, efficient, and theory-grounded concept removal. Across a wide range of experiments, including object and style erasure on multiple Stable Diffusion variants and the flow-matching model (FLUX), our approach matches or surpasses the performance of state-of-the-art methods while preserving non-target concepts more faithfully. Requiring only a few seconds to apply, it offers a lightweight and drop-in tool for controlled model editing, advancing the goal of safer and more responsible generative models.

Figures & tables

Object	Target Class	Erased Accuracy (%) $\downarrow$					Other Classes	Preservation Drop (%) $\downarrow$
Object	Original	ESD	CP	AGE	UCE	DP	Original	ESD	CP	AGE	UCE	DP
Cassette Player	$78.0$	$20.5_{\pm 1.5}$	$4.3_{\pm 0.3}$	$24.0_{\pm 1.0}$	$12.0^{\dagger}$	2.0	$86.8$	$22.6_{\pm 3.1}$	$31.7_{\pm 3.5}$	$5.8_{\pm 0.4}$	$20.8$	3.3
Chain Saw	$80.0$	$\textbf{0.0}_{\pm 0.0}$	$1.0_{\pm 0.0}$	$1.0_{\pm 0.0}$	0.0	0.0	$86.6$	$22.4_{\pm 1.7}$	$34.1_{\pm 3.2}$	$6.7_{\pm 0.5}$	$0.6$	0.3
Church	$84.0$	$\textbf{4.0}_{\pm 1.0}$	$24.6_{\pm 0.6}$	$16.3_{\pm 1.7}$	4.0	4.0	$86.1$	$25.3_{\pm 2.1}$	$17.4_{\pm 1.0}$	$7.2_{\pm 0.4}$	$15.1$	6.1
Gas Pump	$77.0$	$8.3_{\pm 1.0}$	$4.0_{\pm 0.7}$	$4.0_{\pm 1.0}$	$6.0$	2.0	$86.9$	$14.1_{\pm 1.7}$	$31.8_{\pm 2.1}$	$3.9_{\pm 0.3}$	$5.6$	2.6
Tench	$73.0$	$3.0_{\pm 1.0}$	$\textbf{0.0}_{\pm 0.0}$	$12.0_{\pm 2.0}$	0.0	0.0	$87.3$	$12.1_{\pm 1.1}$	$34.3_{\pm 3.1}$	$6.4_{\pm 0.3}$	$9.9$	4.6

Table 1: Results on SD 1.4 for all algorithms. Each block includes both original and post-update accuracies. Left: Target Class shows erasure performance ( Erased Accuracy

\downarrow

). Right: Other Classes reports the accuracy of preserved concepts ( Preservation Drop

\downarrow

). Lower values indicate stronger erasure and better preservation. Note: UCE and DP are deterministic methods and thus no standard deviation is reported. † Detailed analysis of why UCE performs worse in these two cases are provided in the Appendix D.

Style	Target Class	Erased Accuracy (%) $\downarrow$					Other Classes	Preservation Drop (%) $\downarrow$
Style	Original	ESD	CP	AGE	UCE	DP	Original	ESD	CP	AGE	UCE	DP
Andy Warhol	$86.0$	$14.7_{\pm 1.3}$	$21.5_{\pm 2.0}$	$31.5_{\pm 3.0}$	$15.0$	12.5	$92.1$	$4.9_{\pm 2.1}$	$10.4_{\pm 1.4}$	$5.2_{\pm 0.7}$	$2.1$	2.0
Caravaggio	$82.0$	$23.3_{\pm 1.3}$	$20.3_{\pm 1.3}$	$\textbf{7.5}_{\pm 1.0}$	$16.0$	$11.5$	$93.6$	$8.8_{\pm 2.1}$	$27.5_{\pm 3.2}$	$11.4_{\pm 1.1}$	$0.7$	0.4
Pablo Picasso	$81.5$	$40.5_{\pm 2.0}$	$\textbf{24.5}_{\pm 2.5}$	$26.0_{\pm 1.0}$	$30.0$	$26.0$	$91.4$	$14.7_{\pm 1.2}$	$13.4_{\pm 2.1}$	$4.3_{\pm 0.3}$	$2.9$	2.6
Rembrandt	$85.0$	$18.0_{\pm 2.0}$	$15.0_{\pm 1.0}$	$3.5_{\pm 0.5}$	$4.5$	3.0	$84.4$	$8.8_{\pm 0.9}$	$23.3_{\pm 2.1}$	$6.9_{\pm 0.7}$	$-1.0$	-1.4
Van Gogh	$63.0$	$8.5_{\pm 0.5}$	$14.7_{\pm 1.7}$	$17.7_{\pm 0.3}$	$7.0$	5.5	$89.9$	$6.7_{\pm 0.6}$	$8.9_{\pm 1.2}$	$5.8_{\pm 0.4}$	$0.8$	-1.3

Table 2: Results on SD 1.4 for artistic style erasure . Each block includes both original and post-update accuracies. Note: each artist is given a set of its own labels to compute the CLIP score. UCE and DP are deterministic methods and no standard deviation is reported.

Metric	Cassette Player	Chain Saw	Church	Gas Pump	Tench	Garbage Truck	English Springer	Golf Ball	Parachute	French Horn	Mean
Target Class (Erased Accuracy, % $\downarrow$ )
Original	39.0	100.0	99.0	100.0	89.0	98.0	82.0	100.0	99.0	100.0	90.6
UCE	0.0	0.0	63.0	73.0	6.0	21.0	0.0	76.0	0.0	0.0	23.9
DP	0.0	0.0	12.0	0.0	0.0	0.0	0.0	1.0	0.0	0.0	1.0
Other Classes (Preservation Drop, % $\downarrow$ )
Original	96.3	89.6	89.7	89.6	90.8	89.8	91.6	89.6	89.7	89.6	90.6

Table 3: Results on the FLUX model for object erasure. Rows 1–3 report target erasure ( Erased Accuracy

\downarrow

). Rows 4–6 report preservation fidelity ( Preservation Drop

\downarrow

). Visualization of sample generated images is available in Appendix H .

Figure 1: Visualization of concept erasure on “Cassette player”. Results indicated that the target concept (column 1) is effectively suppressed, while the remaining nine categories (columns 2–10) show minimal impact.

Figure 2: Computation time comparison across erasure methods (log scale). Results indicate that closed-form approaches such as UCE and DP perform concept erasure within only a few seconds. Experiments are conducted for SD 1.4 on Nvidia 3090.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Target Concept	Cassette Player	Chain Saw	Church	English Springer	French Horn	Garbage Truck	Gas Pump	Golf Ball	Parachute	Tench
Anchor Concept	Box	Stick	Temple	Cat	Drum	Bus	Dispenser	Sphere	Cloth	Cucumber

Appendix

Table 4: Anchor concepts used for object-level concept erasure. Each target is paired with a fixed anchor to ensure consistent proxy vectors across UCE and DP.

Concept	LPIPS $\downarrow$		PSNR (dB) $\uparrow$		SSIM $\uparrow$		FID $\downarrow$
Concept	UCE	DP	UCE	DP	UCE	DP	UCE	DP
Cassette Player	$0.1170_{\pm 0.0287}$	$\mathbf{0.0506}_{\pm 0.0248}$	$19.60_{\pm 2.47}$	$\mathbf{24.61}_{\pm 4.45}$	$0.8019_{\pm 0.0580}$	$\mathbf{0.8883}_{\pm 0.0559}$	14.29	$\mathbf{8.57}$
Chain Saw	$0.1113_{\pm 0.0262}$	$\mathbf{0.0362}_{\pm 0.0339}$	$19.79_{\pm 2.47}$	$\mathbf{26.63}_{\pm 4.90}$	$0.8060_{\pm 0.0600}$	$\mathbf{0.9141}_{\pm 0.0518}$	11.87	$\mathbf{5.44}$
Church	$0.1222_{\pm 0.0282}$	$\mathbf{0.0388}_{\pm 0.0208}$	$19.33_{\pm 2.41}$	$\mathbf{25.73}_{\pm 4.24}$	$0.7964_{\pm 0.0617}$	$\mathbf{0.9091}_{\pm 0.0461}$	14.25	$\mathbf{6.86}$
English Springer	$0.1225_{\pm 0.0397}$	$\mathbf{0.0836}_{\pm 0.0378}$	$19.36_{\pm 2.51}$	$\mathbf{21.68}_{\pm 3.19}$	$0.7911_{\pm 0.0608}$	$\mathbf{0.8404}_{\pm 0.0600}$	14.74	$\mathbf{11.28}$
French Horn	$0.1211_{\pm 0.0317}$	$\mathbf{0.0367}_{\pm 0.0202}$	$19.75_{\pm 2.40}$	$\mathbf{26.43}_{\pm 4.03}$	$0.7995_{\pm 0.0646}$	$\mathbf{0.9110}_{\pm 0.0483}$	14.92	$\mathbf{6.76}$

Appendix

Table 5: Comparison of DP and UCE across preserved concepts using LPIPS , PSNR , SSIM , and FID . Lower is better for LPIPS and FID; higher is better for PSNR and SSIM.

Object	Target Class	Erased Accuracy (%) $\downarrow$					Other Classes	Preservation Drop (%) $\downarrow$
Object	Original	ESD	CP	AGE	UCE	DP	Original	ESD	CP	AGE	UCE	DP
Cassette Player	$60.0$	$12.0_{\pm 1.0}$	$4.0_{\pm 0.5}$	$33.0_{\pm 3.7}$	$41.0$	$\mathbf{0.0}$	$88.8$	$25.9_{\pm 2.1}$	$27.4_{\pm 1.9}$	$6.3_{\pm 0.4}$	$20.4$	$\mathbf{4.2}$
Chain Saw	$76.0$	$1.0_{\pm 0.0}$	$\mathbf{0.0}_{\pm 0.0}$	$2.0_{\pm 0.5}$	$\mathbf{0.0}$	$\mathbf{0.0}$	$87.0$	$18.1_{\pm 1.8}$	$29.1_{\pm 2.2}$	$1.6_{\pm 0.2}$	$2.3$	$\mathbf{0.2}$
English Springer	$95.0$	$1.0_{\pm 0.0}$	$\mathbf{0.0}_{\pm 0.0}$	$\mathbf{0.0}_{\pm 0.0}$	$\mathbf{0.0}$	$\mathbf{0.0}$	$84.9$	$43.9_{\pm 2.4}$	$32.6_{\pm 1.9}$	$1.9_{\pm 0.3}$	$2.1$	$\mathbf{-0.2}$
Parachute	$93.0$	$5.0_{\pm 0.7}$	$5.0_{\pm 0.5}$	$2.0_{\pm 0.5}$	$\mathbf{0.0}$	$\mathbf{0.0}$	$85.1$	$10.4_{\pm 1.1}$	$37.7_{\pm 2.8}$	$1.3_{\pm 0.2}$	$\mathbf{0.3}$	$\mathbf{0.3}$
French Horn	$99.0$	$2.0_{\pm 0.3}$	$\mathbf{0.0}_{\pm 0.0}$	$3.0_{\pm 1.0}$	$\mathbf{0.0}$	$1.0$	$84.4$	$17.1_{\pm 1.6}$	$29.3_{\pm 2.3}$	$4.7_{\pm 0.4}$	$\mathbf{1.6}$	$2.4$

Appendix

Table 6: Results on SD 1.5 for all algorithms. Each block includes both original and post-update accuracies. Left: Target Class shows erasure performance ( Erased Accuracy

\downarrow

). Right: Other Classes reports the accuracy of preserved concepts ( Preservation Drop

\downarrow

). Lower values indicate stronger erasure and better preservation.

Figure 3: Concept erasure on “Cassette Player” with anchor concept “Box”. The first column shows the target concept to be erased.

Panel of Figure 4 — Figure 4: Concept erasure on a few target concepts with FLUX. Results demonstrate that the proposed DP method successfully suppresses the target concept while generating images faithful to the replaced anchor concept.

Method	Target Concept: Church			Other Classes (Avg.)
Method	Original	After Erasure $\downarrow$	Drop $\uparrow$	Original	After Erasure $\uparrow$	Drop $\downarrow$
Factory only	99.0%	12.0%	87.0%	89.7%	89.4%	0.3%
Tower + Factory	99.0%	3.0%	96.0%	89.7%	89.6%	0.1%

Appendix

Table 7: Ablation study on the construction of the safe subspace for the target concept Church . We compare a multi-vector safe region (Tower + Factory) with a single-vector anchor (Factory). Left block reports erasure performance; right block reports preservation quality on non-target classes.

Class	Original	UCE		DP
Class	Original	Preserved $\uparrow$	Drop $\uparrow$	Preserved $\uparrow$	Drop $\uparrow$
African elephant	85.0%	79.0%	+6.0%	84.0%	+1.0%
airliner	96.0%	94.0%	+2.0%	96.0%	+0.0%
beer bottle	96.0%	91.0%	+5.0%	96.0%	+0.0%
coffee mug	71.0%	66.0%	+5.0%	70.0%	+1.0%
loudspeaker	93.0%	95.0%	-2.0%	96.0%	-3.0%

Appendix

Table 8: Classification accuracy comparison on general ImageNet classes before and after concept erasure on ”Cassette Player”. “Original” denotes accuracy on the unmodified model. “Preserved” is accuracy after applying UCE or DP. “Drop” is defined as (Original

-

Preserved), where smaller drops (bold) indicate better preservation of general concepts.

Concept Erasure

Concept erasure removes specified knowledge or attributes from models while preserving their ability to perform unrelated tasks.

See all 61 papers

Prototype-Guided Concept Erasure in Diffusion Models
Mar 9, 2026Yuze Cai, Jiahao Lu, Hongxiang Shi +2Concept Erasure Safe T2I Generation
Fudan University · National University of Singapore
Orthogonal Concept Erasure for Diffusion Models
May 27, 2026Yuhao Sun, Lingyun Yu, Haoxiang Xu +3Model Editing Concept Erasure
University of Science and Technology of China · Ant Group
EGLOCE: Training-Free Energy-Guided Latent Optimization for Concept Erasure
Apr 10, 2026Junyeong Ahn, Seojin Yoon, Sungyong BaikDiffusion Model Unlearning Safe T2I Generation
KAIST AI · Hanyang University

Mar 9, 2026J/K move · Enter open · S save

Prototype-Guided Concept Erasure in Diffusion Models

Yuze Cai, Jiahao Lu, Hongxiang Shi, Yichao Zhou+1

Fudan University · National University of Singapore

Concept Erasure Safe T2I Generation T2I Diffusion Models Diffusion Model Unlearning Diffusion Model Guidance

Open paper AskPDF arXiv

Concept erasure is extensively utilized in image generation to prevent text-to-image models from generating undesired content. Existing methods can effectively erase narrow concepts that are specific and concrete, such as distinct intellectual properties (e.g. Pikachu) or recognizable characters (e.g. Elon Musk). However, their performance degrades on broad concepts such as sexual'' or violent'', whose wide scope and multi-faceted nature make them difficult to erase reliably. To overcome this limitation, we exploit the model's intrinsic embedding geometry to identify latent embeddings that encode a given concept. By clustering these embeddings, we derive a set of concept prototypes that summarize the model's internal representations of the concept, and employ them as negative conditioning signals during inference to achieve precise and reliable erasure. Extensive experiments across multiple benchmarks show that our approach achieves substantially more reliable removal of broad concepts while preserving overall image quality, marking a step towards safer and more controllable image generation.

Abstract

Concept Erasure

Explore similar work

Prototype-Guided Concept Erasure in Diffusion Models

Orthogonal Concept Erasure for Diffusion Models

EGLOCE: Training-Free Energy-Guided Latent Optimization for Concept Erasure