Erasing Concept Combination from Text-to-Image Diffusion Model

Thank you for your time and efforts in reviewing our paper. Please find our responses below to your concerns.

W1. The paper serves as a blue team tool to defend DMs against inappropriate contents. However, as far as I know, there have already been some quite strong red team tools for this topic, such as [1] and [2]. The paper doesn't show its performance against these red team tools.

A1. We appreciate your thoughtful feedback, and we would like to clarify the setting and contribution of our proposed approach, as well as address the absence of specific evaluations against existing red team tools. 

1. Setting and Contribution of Our Approach: The focus of our work is on providing a patching mechanism for text-to-image diffusion models to proactively eliminate specific concept combinations that may lead to inappropriate or undesirable outputs. Our goal is to design a framework that can effectively decouple and erase harmful concept combinations while maintaining the generation quality for individual concepts. This ensures that the diffusion models are not only restricted from generating potentially harmful or inappropriate outputs, but also continue to generate high-quality individual concepts.

 2. Focus on Patching Rather Than Attack-Defense Dynamics: Unlike typical attack-defense (i.e., red team vs. blue team) dynamics, our primary contribution lies in patching diffusion models to ensure that they are better suited for responsible use. In the current scope of our work, we do not focus on directly counteracting or defending against malicious prompts specifically crafted by red team tools to bypass safety measures. The challenge of dealing with adversarial inputs designed to circumvent defenses is an important area of research, but it was not within the core scope of our study.  The setting and design of our approach aim to provide a patch-oriented solution for models such as ​Stable Diffusion​. We focus on eliminating the ability to generate harmful combinations through parameter-level modifications, which effectively act as a safeguard against unintended or accidental generation of inappropriate content. Unlike adversarial defense mechanisms that are designed to counteract targeted and malicious red team inputs, our approach is intended as a preventative solution for general use cases where users inadvertently input prompts that could lead to inappropriate generations.

In summary, we agree that testing the model’s resilience against red team tools is an important aspect, and we acknowledge that this could serve as a next step in extending the robustness of our method. Our current work does not consider maliciously crafted inputs that are specifically designed to bypass erasure mechanisms. Instead, we aim to mitigate the risk of generating inappropriate content in a standard setting where users may use prompts that unintentionally combine benign concepts into inappropriate ones. This makes our focus quite different from the typical adversarial scenarios addressed by red team attacks.

W3. Although the paper highlights that COGFD preserves individual concepts, it falls short of providing an in-depth analysis of whether any degree of concept erosion still occurs for these harmless concepts. For example, does image quality deteriorate in certain combinations? Are there instances where the method unintentionally modifies the appearance or characteristics of harmless concepts (e.g., distorting 'wine' when used alone after its combination with 'kids' is erased)?

A3. We appreciate your thoughtful observations and would like to provide more clarity on the extent to which fine-tuning affects individual concepts in our COGFD approach.

1. Side effect of Fine-Tuning: Similar to other baseline methods such as CA and FMN, COGFD utilizes parameter fine-tuning of the diffusion model to achieve the desired erasure of inappropriate concept combinations. As with any fine-tuning process, this approach can indeed lead to some degree of degradation in the quality of generated outputs. This phenomenon has been discussed and documented extensively in prior research, including works like [1] and [2]. We observe that this degradation is unavoidable to some extent, given that parameter-level adjustments are being made to restrict certain generative capabilities, which can indirectly affect related features.

• [1] Universal Language Model Fine-tuning for Text Classification, ACL 2018
• [2] Revisiting few-sample {bert} fine-tuning, ICLR 2021

2. Empirical Evidence of Concept Erosion: In our experiments, we did observe some degree of quality deterioration in individual concepts after the fine-tuning process, particularly in scenarios involving multiple rounds of fine-tuning. Specifically:

• As shown in Figure 7, we demonstrate instances where the fine-tuning process results in changes to the generative output, with certain concepts appearing less distinct or with minor artifacts.
• Figure 6 further illustrates that as the number of fine-tuning rounds increases, the Clip Score for individual concepts tends to decline, which is indicative of a gradual erosion in the quality and distinctiveness of those concepts. This is consistent with findings in other studies that also leverage fine-tuning approaches [1-2].

3. Mitigating Concept Erosion and Future Work: While we acknowledge that fully avoiding concept erosion remains a significant challenge—one that is beyond the scope of the present study—we believe that COGFD makes substantial progress compared to existing approaches. Specifically, our high-level feature decoupling mechanism significantly reduces the impact on harmless individual concepts compared to traditional concept erasure methods. However, it is true that some quality deterioration may still be observed, especially when there are complex, subtle dependencies between features in the erased combination and the retained concepts. Moving forward, we plan to further investigate how to better control the fine-tuning process to mitigate these unintended impacts on generation quality. This could include exploring regularization techniques to maintain feature consistency or developing more advanced decoupling strategies to limit the erosion effect even further.

Thank you once again for your insightful feedback. We hope our clarifications address your concerns. Please let us know if you have further suggestions or need additional details.

Thank you for your time and efforts in reviewing our paper. Please find our responses below to your concerns.

W1. The proposed solution may be overly complex. Current standard methods for preventing the generation of inappropriate concepts typically employ safety alignment techniques. A more straightforward approach could involve using a Large Language Model (LLM) to manage safety alignment. For instance, querying GPT-4 or Gemini about the appropriateness of a concept combination could yield direct feedback. An LLM can promptly identify and indicate whether a combination poses any issues for generation.

A1. We appreciate your thoughtful suggestion and acknowledge that leveraging an LLM for safety alignment is indeed a practical and effective approach for many scenarios. However, we would like to clarify our motivation for developing an approach that works at the model parameter level, especially for open-source diffusion models.

1. Limitations of LLM-based Safety Filtering: The method suggested by the reviewer, which involves querying an LLM (e.g., GPT-4 or Gemini) for safety alignment, essentially serves as a pre-processing or post-processing filter that can be effective in closed-source environments. Such safety filtering is indeed suitable for centralized services where model providers can enforce safety mechanisms consistently.

However, for open-source diffusion models such as Stable Diffusion (SD), safety filters implemented in this manner can often be disabled or circumvented by end-users. This makes it difficult to enforce robust safety alignment, particularly when the models are deployed in decentralized, user-controlled environments. In contrast, our proposed method, which focuses on erasing specific concept combinations at the model parameter level, provides a more secure and persistent solution for open-source settings. By fundamentally altering the model's internal capacity to generate inappropriate concept combinations, we offer a more resilient defense that cannot be easily bypassed by modifying or disabling safety filters. This approach is consistent with prior research on concept erasure in diffusion models (e.g., CA [1], FMN [2], UCE [3], SALUN [4], and ESD [5]), which demonstrate the need for deep parameter-level interventions in open models to achieve long-term reliability in concept control.

• [1] Ablating concepts in text-to-image diffusion models, ECCV 2023

• [2] Forget-me-not: Learning to forget in text-to-image diffusion models, arXiv 2023

• [3] Unified concept editing in diffusion models, ECCV 2023

• [4] Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation, ICLR 2024

• [5] Erasing concepts from diffusion models, ECCV 2023

2. Broader Motivation Beyond Harmful Content: Another key motivation for our work is that the problem we are addressing extends beyond merely blocking harmful content. It also involves scenarios related to copyright protection and privacy concerns. In some instances, individuals or organizations may request the erasure of specific content that involves copyrighted material or personal data, which means that a model’s ability to generate such content must be directly altered. For instance, compliance with EU regulations—such as the "right to be forgotten" under the GDPR—requires direct modifications to the model to ensure that certain content can no longer be generated. In such cases, LLM-based querying for safety alignment would not be sufficient, as these requirements mandate fundamental changes to the model’s generative capabilities to guarantee that particular content combinations are no longer accessible. Our proposed approach, Concept Graph-based high-level Feature Decoupling (COGFD), provides a pathway to permanently alter the model to meet these requirements. By directly modifying the model parameters, we ensure compliance with such legal and ethical standards, which is not achievable through surface-level filtering alone.

In conclusion, while using LLM-based safety alignment can be effective as a layered safety mechanism, particularly in closed-source settings, our approach addresses the unique challenges posed by open-source models and the growing need for persistent and enforceable control over generated content for issues that include safety, copyright, and privacy.

Thank you for your time and effort in reviewing our paper. Please find our responses to your concerns below.

W1. The formulation of the Concept Combination Erasing (CCE) problem in Definition 3.1 lacks comprehensiveness. Important aspects such as taxonomy, problem scenarios, implications, and practical significance were not adequately addressed. Furthermore, regarding the cases shown in Fig. 1(a), it was suggested that some of these examples may not be relevant to the CCE problem.

A1. We appreciate the comment regarding the formulation of the Concept Combination Erasing (CCE) problem and the request for a more comprehensive description. Our primary contribution in this work lies in identifying the practical need for erasing concept combinations in real scenarios, and proposing a corresponding technical solution. Hence, while a more detailed categorization and analysis of the problem scenarios would indeed be valuable, it was beyond the main scope of our current study. We have formalized the CCE problem in Definition 3.1, aiming to capture the core challenge: effectively erasing certain visual concept combinations without impairing the model's ability to generate the individual visual concepts.

Regarding the specific examples you mentioned:

"A male wears blue tights and red cape": This scenario is indeed a classic example of a copyright issue arising from the combination of multiple visual concepts. We believe that directly erasing this specific combination may significantly affect the generative performance of concepts such as "male", "tights", and "red cape".

"Polar bear chases penguin": We understand your perspective that this does not pose a clear safety or copyright risk. However, our inclusion of this scenario was to highlight logical inconsistency, which can contribute to misleading or incorrect generated images that affect human perception. This type of generated content could indeed influence viewers negatively by promoting false information, and thus we consider it as part of AIGC safety issues that CCE aims to mitigate.

W2. Building upon the first point, it seems that the authors are unclear about the specific application scenarios of CCE. For example, in Fig. 4, there are cases about 'Cat and Woman,' 'Car and Tree,' 'Child and Flower.' These common concept combinations seem unrelated to security issues. Is it necessary for us to conduct disentanglement on these concept combinations?

A2. We appreciate your observation and would like to clarify the intent behind including these specific case studies. The examples presented in Fig. 4 were not intended to represent practical application scenarios directly related to security or safety concerns. Instead, they were included to demonstrate the effectiveness of our approach （CoGFD） in disentangling visual concept combinations.

These case studies serve as proof-of-concept illustrations to highlight the technical capabilities of our method—specifically, its ability to successfully identify and erase concept combinations, while retaining the generative quality of individual components within those combinations. We believe that this demonstration is important for understanding the general applicability of COGFD to a broad range of visual concepts, irrespective of whether they present specific security concerns.

W3. It appears that the CONCEPT LOGIC GRAPH GENERATION WITH LLMs process requires manual annotations from the reviewer, which limits the flexibility and scalability of the method. Is there an automated annotation solution available?

A3. There might be confusion regarding the concept logic graph generation process. To clarify, manual annotation is not required in our approach. The concept logic graph is entirely generated autonomously by two interacting agents—namely, the Generator and the Reviewer agents. These agents work together iteratively, where the Generator constructs the concept logic relationships, and the Reviewer checks for accuracy and provides feedback to ensure high-quality graph generation.

The Reviewer agent mentioned is itself an automated entity, not a human reviewer. It interacts with the Generator to iteratively refine and improve the concept logic graph without the need for any human intervention. The use of this two-agent system enables our method to achieve a high level of accuracy while maintaining flexibility and scalability in generating concept logic graphs.

W4. Building upon the third point, how many prompts were used during training, and what were they like?

A4. The prompts used during the concept logic graph generation process were designed specifically to guide the Generator and Reviewer agents in an interactive manner. In the Appendix of the paper, we have provided examples of the system prompts used by both agents (see Appendix A.1).

Thank you for your time and efforts in reviewing our paper. Please find our responses below to your concerns.

W1. The Reviewer agent's functionality may be limited. According to Appendix A.1, the Reviewer only checks the correctness of the Generator’s output without providing revision suggestions, contrary to what is stated in Section 3.2.1. This limitation could reduce the effectiveness of the concept logic graph generation. It would be helpful to include details of the generation process for each round in the Appendix to validate the roles of both the Generator and Reviewer in the pipeline.

A1. We appreciate your careful review of our methodology and your comments regarding the interaction between the Generator and Reviewer agents. Allow us to clarify the functionality and the intended role of the Reviewer agent.

1. Reviewer Provides Revision Suggestions: In our design, the Reviewer agent is indeed capable of providing revision suggestions to the Generator agent, as explicitly outlined in the system prompt provided in Appendix A.1. Specifically, the Reviewer’s prompt includes the instruction: “If there are some mistakes in the generated graph, please point them out and tell the Generator how to fix them.” This ensures that the Reviewer agent does more than simply identify errors; it actively contributes to refining and improving the concept logic graph by guiding the Generator on how to address the detected issues. The goal of this iterative interaction is to ensure that the concept logic graph is generated with high accuracy and quality, enhancing the overall effectiveness of the graph generation process.

2. Interaction Logs between the Generator and Reviewer: To provide greater transparency and to validate the role of both agents in the pipeline, We have placed the interaction log in the comments box below for demonstration purposes. These logs will illustrate how the Reviewer identifies issues and provides specific revision suggestions to the Generator. By including this detailed interaction process, we hope to make it clear how each agent contributes to the generation of a high-quality concept logic graph, thereby addressing any perceived limitations in the Reviewer's functionality. We will include these interaction logs in the appendix of the paper.

We believe these explanations will effectively demonstrate that the Reviewer agent plays an active and crucial role in the concept logic graph generation process, thereby ensuring that the output is both correct and optimized. The inclusion of these detailed logs in the revised Appendix should also help illustrate the iterative refinement process and validate the contributions of both agents.