Prompt-Agnostic Erasure for Diffusion Models Using Task Vectors

Thank you very much for your detailed review. We appreciate that you acknowledged our motivation for robust model editing methods, and found our paper well-organized and clearly written. We address each of your questions below:

“... a brief explanation of the model architecture and how the blocks relate to different levels of abstraction or functionality.” “What was the rationale for choosing to edit only the first three blocks in the model? Would the authors consider expanding on why these specific blocks were selected for editing?”

The UNet of Stable Diffusion 1.4 consists of an encoder with 12 blocks, a middle block, and a skip-connected decoder with 12 blocks. Motivated by [1], we hypothesize that the Task Vector might contain some noise and not all weights should be edited. Works such as [2] highlight the different functions of different layers. Namely, some Unet blocks relate to more abstract concepts, while others relate to colors, textures, or compositions. Our experiments suggest that we can set certain weights of the Task Vector to zeros to achieve better robustness versus utility trade-off.

We provide additional results on pruning more blocks in Appendix C. Our claim is that the Erasure Score may allow a better exploration of the possible trade-off, rather than highlighting any specific choice.

“Alpha Parameter Choice: The choice of α is not well-clarified. While Figure 4 mentions α, no figure or table apart from Figure 7 details the specific α values used.”

After obtaining the diverse set of embeddings through Diverse Inversion. We then look through the images that give the highest Erasure Score to and pick the alpha value that yields sufficient erasure. We observe that for most objects, an alpha between 1.25 to 1.75 is sufficient for robust erasure. On the other hand, we use an alpha between 2.0 and 2.5 for styles.

“ It would improve readability and flow by moving the figure closer to its initial mention or adding an earlier reference to it in the text” , “Equation Definition: In Equation 4, the variables [a, b] and [c, d] are not clearly defined.”

We thank the reviewer for pointing this out, we revised the manuscript accordingly.

“ Could the authors clarify the meaning of “SLD-Med” in Table 2 (page 10) and confirm if it is the same as “UCE” mentioned briefly in the related work section?”

SLD stands for Safe Latent Diffusion [3] which is an inference-guiding-based concept erasure method. In particular, this method modifies the inference process to divert the final output from undesired concepts. The original paper proposes 4 variants SLD-Weak, SLD-Medium, SLD-Strong, and SLD-Max that correspond to erasure strength. We followed previous literature and chose SLD-Med for our experiments. UCE stands for Unified Concept Editing [4] which is a fine-tuning-based method for concept erasure. We will clarify the meaning of SLD-Med in the main text.

We thank the reviewer for their detailed suggestion and revised the manuscript accordingly.

Thank you very much for your comments. We respectfully ask that if you feel more positively about our paper, please consider updating your score. If not, please let us know what can be further improved; we are happy to continue the discussion any time until the end of the discussion period. Thank you!

References:

[1] Prateek Yadav, Derek Tam, Leshem Choshen, Colin A. Raffel, Mohit Bansal. “TIES-Merging: Resolving Interference When Merging Models”. NeurIPS 2023

[2] Viacheslav Surkov, Chris Wendler, Mikhail Terekhov, Justin Deschenaux, Robert West, Caglar Gulcehre. "Unpacking SDXL Turbo: Interpreting Text-to-Image Models with Sparse Autoencoders.", Preprint 2024

[3] Patrick Schramowski, Manuel Brack, Björn Deiseroth, Kristian Kersting. “Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Models”, CVPR 2023

[4] Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzynska, David Bau. "Unified Concept Editing in Diffusion Models", WACV 2024

Dear Reviewer,

We sincerely appreciate your valuable feedback and the time you have dedicated to reviewing our submission. Your insights have been instrumental in shaping the final version of our submission.

We would like to kindly remind you that the discussion period is set to conclude on December 2nd. If there are any additional questions, concerns, or clarifications, we would be delighted to continue the discussion.

Thank you once again for your attention. We look forward to hearing from you!

Thank you for your detailed review. We appreciate that you recognized our motivating analysis and found our paper is easy to follow. We address each of your questions below:

“...it would be good if quantitative evaluation included diverse adversarial techniques in addition to concept inversion…”

We thank the reviewer for their suggestion. To provide additional quantitative results, we performed UnlearnDiffAtk and P4D on two erased models using ESD and TV. We computed CLIP scores across 10 runs. The results are summarized in the table below:

“it would be good to show the method works also on other models than Stable Diffusion v1.4 specifically”

We thank the reviewer for their suggestion. We provide additional results on Stable Diffusion 2.0 in Section C.3 of the Appendix.

“The method seems to be primarily a combination of task vector technique and a version of text inversion”

We would like to highlight identifying the prompt dependence as the source of vulnerability in previous concept erasure methods. This is a main contribution of our work.

“issues with the writing and presentation”

We thank the reviewer for pointing this out. All editorial issues are addressed in the revised version.

“What could the prompts look like for a given complexity class L? Does it directly translate to the number of words?”

For standard Text-to-Image models the complexity class L indeed corresponds to prompts of length of L tokens.

As in our toy experiments a dense input space for conditional generation (instead of text), we define the complexity class L as containing inputs of the form:

$\left(\frac{2l_0 - L}{L}, \frac{2l_1 - L}{L}, \dots, \frac{2l_d - L}{L}\right)$

where each input vector has d dimensions, and each $l_i \in [0 .. L]$.

Namely, higher complexity classes correspond to more specification options in the input space of the conditional generation; this is analogous to the case in standard Text-to-Image models.

“Can this method actually remove small parts of the image such as copyright logos? It was used in motivation but seems to not be tested?”

We aim to remove copyrighted content. The copyright law may vary between states, and may also contain the generation of artistic styles, fictional characters, or even letter fonts. Yet, generating small logos is hard to evaluate, as SD models typically would not produce them; neither would they significantly affect the CLIP score. In any case, our method can erase logos, similarly to any other object, but evaluation of small logos is difficult, and we do not claim it to be a use case special to our technique. We could not find a prompt that generates very small logos consistently (even without erasure). We are happy to evaluate any given prompt.

We clarified this in the revised manuscript.

“Does the approach work well also on other diffusion models than Stable Diffusion v1.4?”

We thank the reviewer for the suggestion. We provide additional results on Stable Diffusion 2.0 in Section C.3 of the Appendix. Our results suggest that TV can provide robustness against Concept Inversion for Stable Diffusion 2.0 on the Van Gogh concept.

Thank you very much, once again, for your excellent comments. We added these additional experiments and explanations to the revised manuscript.

We respectfully ask that if you feel more positive about our paper, to please consider updating your score. If not, please let us know what can be further improved; we are happy to continue the discussion any time until the end of the discussion period. Thank you!

Thank you for acknowledging our rebuttal and continuing the discussion.

Following the reviewer's suggestion we include a quantitative evaluation of our results with SD2.0, following the evaluation setup similar to Table 2 in our submission (Acc. % with the given prompt / Acc. % with CI adversarial method):

We see that our method is erasing concepts effectively for SD2.0 as well. We include it along with additional qualitative results in the manuscript.

The tables and fonts are now consistent (apart from table 2 which intentionally has smaller fonts). We also changed the color of the edits to purple per the reviewer’s request.

Regarding novelty - We would like to emphasize that our analysis of the input complexity is novel, as well as using it to understand the importance of prompt independence. It motivates the technical solution we chose, which indeed relies on existing works that were previously used in other contexts. We believe that a well-motivated solution with a limited technical novelty may serve the community better than a solution optimized for novelty but not necessarily for effectiveness.

Thank you once again for your suggestions for our work as well as your follow-up comment!

Dear Reviewer,

We appreciate your time and effort in reviewing our work and are pleased that you have a better view of it.

We would like to kindly remind you that the discussion period is nearing its conclusion. One other reviewer has engaged with our response so far, and has increased their score to 8: accept, good paper. The other two reviewers have not yet engaged with our rebuttal, but we believe that our responses address their concerns as well.

We would greatly appreciate it if you could kindly reconsider your evaluation.

Thank you very much for your time and consideration.

Thank you very much for your detailed review. We appreciate that you found our ideas interesting and novel, and even potentially enhancing the understanding of concept learning and erasure processes. We address each of your questions below:

“Certain aspects of the experimental workflow are not sufficiently detailed.”

During Diverse Inversion, we set a and b in Equation 4 to be 0.1 and 0.15. Additionally, we optimize 20 embeddings for each [c, d] interval [0, 0.2], [0.2, 0.4], [0.4, 0.6], [0.6, 0.8], [0.8, 1]. These 5 runs would result in a total of 100 word embeddings. In some cases, Concept Inversion without the constraints can still lead us to pick the same alpha value as Diverse Inversion. In this case, we would run Concept Inversion 5 times, each time optimizing 20 embeddings simultaneously.

“... it appears that the vector from the Diverse Inversion set, which is utilized for selecting the parameter alpha, was also employed in evaluating the robustness of the methods against Concept Inversion”

We would like to emphasize that when evaluating the robustness we are always using the input most successful in attacking a given defense, so there was no effect on the evaluated robustness of our method. Namely, adding an input that our method is robust against to the evaluation set does not affect its robustness scores. We validated this claim empirically.

“It would be beneficial to include additional visual examples to illustrate the results presented in Table 2.”

We thank the reviewer for the suggestion. We provide additional results for objects in Section C.3 of the Appendix.

“Why is the Control Task not utilized for selecting alpha, alongside the Diverse Inversion set?"

The Control Task can certainly be used to select the value of alpha. While the Erasure Score measures the concept erasure performance, the Control Task score measures the preservation of unrelated concepts. Different users may use both scores simultaneously to choose their optimal point on the offered trade-off by each method (See Fig.4 in the paper).

As our focus is on concept erasure, in our case we first used the Erasure Score to choose a minimal strong enough magnitude \alpha, and then validated that this value indeed preserves the Erasure Score for the examined concepts.

“Can you elaborate on the toy example, specifically regarding the embedding grid search procedure?”

First, we train a generative model for MNIST, conditional on a continuous input space of dimension d=8. We then perform “unconditional” fine-tuning on the digit we want to erase through further training but discard the conditional input embeddings. The fine-tuned model is combined with the original model to compute the Task Vector. The Task Vector is then used to erasure that concept.

After training the models, we evaluate for each complexity parameter L the attack success rate. Namely, we check the probability of generating the supposedly erased concepts. For each value of L, we inspect all the possible conditional inputs (vectors of dimension d=8), of the form: $\left(\frac{2l_0 - L}{L}, \frac{2l_1 - L}{L}, \dots, \frac{2l_d - L}{L}\right)$

where each input vector has d dimensions, and each $l_i \in [0 .. L]$.

As we increase L we inspect more fine-grained options for the conditional input. Intuitively, as $L \to \infty$ we approach “exhaustive search” on the model conditional input.

Thank you again for your excellent comments. We respectfully ask that if you now feel even more positively about our paper, to consider slightly increasing your score. We are happy to continue the discussion at any time until the end of the discussion period. Thank you!

Thank you for acknowledging our rebuttal and for taking the time to review our work!

As the revision period is already over, we would like to assure you that we will incorporate the feedback from all the reviewers in the final version of the manuscript. Moreover, we will include additional concepts, as well as the code for our method.

Thank you once again for a very dedicated review.

Thank you for your detailed review. We appreciate that you found our work sound and interesting, and our evaluations thorough. We address each of your questions below:

“...How does the proposed method perform on multi-concept erasure?...”

We include an evaluation of our methods when erasing multiple concepts at once. Fig 18 in the revised manuscript. We erase both Van Gogh and Thomas Kinkade by first taking the average of both task vectors and then subtract it from the original model. Moreover, for each concept we generate 50 images and compute the average CLIP score to provide quantitative results.

We would like to emphasize that our main improvement over UCE and ESD is in adversarial robustness. As demonstrated by our results, we maintain this prosperity in the multi-concept setting.

“...Comparison to Selective Amnesia (SA) (a strong and very similar baseline in my opinion) is missing from the paper…”

We include additional results on performing Concept Inversion on a model with the Van Gogh concept erased using Selective Amnesia in Section C.3 of the Appendix. Our results suggest that Selective Amnesia does not exhibit robustness as well as our proposed method. This observation is done by [1]. Moreover, we would like to emphasize that while Selective Amnesia is a strong method, it is prompt-dependent. Therefore, as UCE, ESD, and similar methods, it indeed performs well against that prompt but is less robust to unexpected attacks.

“Underperforms baselines on NSFW concepts … This is a major drawback of the method in a real-world setting”

While acknowledging this as a limitation of our method, we would like to emphasize that real-world settings differ from one another, and therefore might require different solutions. E.g., for maintaining copy-rights one may need robustness to unexpected prompts, which is a relative advantage of our method. We believe therefore that there is room for more than one method, until a single method would possibly incorporate all advantages.

We add this discussion as well as the comparison asked by the reviewer to the revised version of the manuscript. Thank you very much, once again, for your excellent comments. We respectfully ask that if you feel more positive about our paper, to please consider updating your score. If not, please let us know what can be further improved; we are happy to continue the discussion any time until the end of the discussion period. Thank you!

References

[1] Minh Pham, Kelly O. Marshall, Niv Cohen, Govind Mittal, Chinmay Hegde. “Circumventing Concept Erasure Methods For Text-To-Image Generative Models”, ICLR 2024

Dear Reviewer,

We sincerely appreciate your valuable feedback and the time you have dedicated to reviewing our submission. Your insights have been instrumental in shaping the final version of our submission.

We would like to kindly remind you that the discussion period is set to conclude on December 2nd. If there are any additional questions, concerns, or clarifications, we would be delighted to continue the discussion.

Thank you once again for your attention. We look forward to hearing from you!

Dear Finn Carter,

Thank you for bringing these works to our attention. While they study similar settings, they are not as focused on understanding adversarial robustness as our work. The Receler method [3] does study robustness, but it does not explore robustness against soft prompt attacks which is a main topic in our paper. Nevertheless, we agree that these works are relevant, and we have revised our manuscript to incorporate them as related works.