Concept Pinpoint Eraser for Text-to-image Diffusion Models via Residual Attention Gate

We thank the reviewer for their insightful comments and for appreciating the solidity and soundness of the theoretical analysis, confirming experimental results and ablation studies, and a clear structure of the paper.

${ }$

Weakness 1. The assumption for the theoretical analysis of the proposed ResAG raises some concerns. According to the paper, Equation 4 holds if the modes of samples can be detected and if $\|f(\mathbf{E})\|_F^2$ small for remaining concepts. How can one determine the modes of samples? Additionally, what threshold for $\|f(\mathbf{E})\|_F^2$ is considered "small enough" to effectively protect the remaining concepts?

Response: Detecting the modes of embeddings of concepts by $f(\mathbf{E})$ can be implemented as a classifier for concepts. To further clarify this, we consider the following simple example:

Let $f(\mathbf{E}) = \alpha(\mathbf{E}) \mathbf{I}$ where $\alpha(\mathbf{E}) \ge 0$, $\mathbf{I}$ is an identity matrix, and $\mathcal{D} _{\textnormal{tar}}$ is the distribution of embeddings for target concepts. Suppose that $\alpha(\mathbf{E})$ can classify the distribution from which embeddings of target concepts are sampled or \alpha(\mathbf{E}) = 1 \ \text{if} \ \mathbf{E} \sim \mathcal{D} _{\text{tar}} \ \text{else} \ 0 \. Then, Equation (4) becomes zero for $\mathbf{E} _{\textnormal{rem}}$, suppressing $\mathbb{E} _{\mathbf{\mathbf{E} _{\textnormal{rem}}}} \left[ \| \Delta \mathbf{W} \mathbf{E} _{\textnormal{rem}} V(\mathbf{E} _{\textnormal{rem}}) \|_F^2 \right]$.

We included this to the main text as Proposition 1 along with additional explanations (Line 205-224). Thus, we replaced the expression "small" with "suppressed to zero" for $\| f(\mathbf{E}) \|_F^2$ (Line 206).

${ }$

Question 1. Multiple typos in the proof of Theorem 1 (Appendix B)

Response: Thank you for pointing out the typos. We incorporated all the corrections into the revision (Line 147, 834, 849-853, 862, 885).

Thank you for providing further explanations. However, I still have two questions regarding the modes of embeddings of concepts and the modifications (lines 218~220) made in the main text. Suppose the target concepts to be erased are "Andrew Garfield", "Bill Clinton", and "Keanu Reeves".

1. What are the modes in this example? Could you please clarify how "modes" are defined in the context of these target concepts?
2. Why would $f(\mathrm{E})$ respond (either activated or suppressed) to the single word "Bill" for the concept "Bill Clinton" or "Bill Murray"? I thought each concept is encoded as a text embedding (i.e., "Andrew Garfield" is encoded as $e_1$, "Bill Clinton" as $e_2$, "Keanu Reeves" as $e_3$, and $\mathrm{E}_{tar}=[e_1, e_2, e_3]$), and $f(\mathrm{E})$ would respond to the full concept embeddings rather than to individual words within those concepts.

We are glad that all of the reviewer’s questions have been addressed. We also appreciate the increase in the score.

We thank the reviewer for their insightful comments and positive feedbacks regarding the solidity and reliability of the theorem proofs, the experiments demonstrating the effectiveness of the proposed approach, and the convincing ablation studies.

${ }$

Weakness 1.The robustness training seems to be a separate endeavor from the residual attention gates, while adversarial training acts more as a supplementary effort to enhance ResAGs. The robustness evaluation is directly performed on the model assessment. Does this indicate that the robustness of the model achieved through direct training is weaker than that of other models?

Response: Direct training our architecture with ResAGs is challenging due to ResAG's nonlinearity. Thus, RARE was developed to synergetically train the network with ResAGs. See the below table, showing the effectiveness of our RARE (can improve both the prior structure without ResAGs and our CPE with ResAGs) as well as the synergy of our RARE (significantly improve our CPE with ResAGs over the prior structure without ResAGs). We added this result in Appendix E. (Line 1522-1526) and Tabel E.5 in the revision.

Table: Ablation of CPE on robust concept erasure against adversarial attack prompts: UnlearnDiff (Zhang et al., 2023c).

${ }$

Weakness 2. Given the proof, the addition of an extra term could be represented by various architectures. However, why do ResAGs demonstrate superior performance? This comparison is missing and not addressed in the discussion or experiments.

Response: Our corollary 1 suggested to use an embedding-dependent projection, which is a switch (gate), so we build up our ResAGs by adding this gate to the usual cross-attention in prior works. However, as suggested, we performed ablation studies as shown in the below table, demonstrating that our ResAG yielded improved performance over gate only or gate with linear projection architectures. We included this ablation study in Appendix E. (Line 1509-1509) and Tabel E.4 in the revision.

Table: Ablation study on the effect of the components of ResAG. The row with bold represents the selected configurations.

${ }$

Weakness 3. A concise algorithm description is recommended to enhance understanding of the training processes.

Response: As suggested, we included the description of the training processes as Algorithm 1 in the revision. To represent this more comprehensively, we revised the notations in Equations (7)-(10) in the main text (Line 256-260, 267-269, 313-315, 319-323). We also included one sentence referring to it (Line 357-358).

We appreciate the reviewer’s thoughtful comments and encouraging feedbacks on the solid mathematical proof, novelty of the proposed training loss function, extensive experiments.

${ }$

Weakness 1. The major weakness of this work is that the propose method may not work in open-source scenarios. Methods like ESD, UCE, RECE, etc. directly modify the UNet, and the LoRA of MACE can merge into the UNet, so all these changes can be directly applied to the UNet, and thus the user can't directly bypass these security mechanisms. CPE uses a non-linear add-on module, which cannot be merged to the UNet, so in the open-source scenario, the user can directly delete the code of the add-on module, thus skipping the security mechanism.

Response: We would like to point out that a misuse is different from an attack to the security mechanism. In fact the user in your example seems like a superuser with all the privileges to access the code, the model and even the computation to run the model and thus has a lot of options to compromise the model like, not only modifying codes as you mentioned, but also fine-tuning the model to recover erased concepts, which can undermine all the works including the merged approaches. This is the case of misusing the open-source code (e.g., misused deepfake for crime), rather than the case of skipping the security mechanism. For example, if one user ran a modified linux kernel on his or her own computer for potentially bad purpose, it is not considered breaking the security mechanism, but misusing the software, to the best of our knowledge.

Security mechanism for the concept erasing in generative diffusion models should be well-defined. For example, attacker can distribute a modified bad code to other users to run, but this attack can be easily detected in open-source scenarios. Another example is for attackers to modify the input to the generative diffusion model during service to output malicious images and this setting has been used in most concept erasing works for robustness evaluation. This setting assumes the limited access of users to the input only, which is realistic in both open-source and closed-source scenarios (e.g., Veo of DeepMind [1], Firefly of Adobe [2], Sora of OpenAI [3], etc.). Thus, we also stick to this setting like prior works (see Table 4 for our results).

[1] https://deepmind.google/technologies/veo/

[2] https://www.adobe.com/products/firefly.html

[3] https://openai.com/index/sora/

${ }$

Question 1. From Table D.7, CPE uses hundreds of anchoring concepts to enhance retention. MACE only used 'a person' in the deletion of celebrities[1]. UCE, RECE only used the provided 1724 styles in the deletion of artistic styles. ESD, UCE, and RECE used only the empty text "", and MACE only used "a person wearing clothes" [2] in the deletion of NSFW concept. Can the authors explain whether the preservation effect of CPE comes from the methods proposed in the main text or from these numerous anchor concepts in the appendix?

Response: Note that our CPE also used "a person" like MACE and other prior works also used multiple anchor concepts as summarized in the below tables. We included them as Table D.3 and Table D.6 in Appendix. Note that MACE used much more than 200 anchor concepts (100 celebrities + much more than 100 captions from MS-COCO) while our CPE used 150 anchor concepts (50 similar concepts selected from 500 celebrities + 100 synonyms with "celebrities"). We believe that the way of using anchor concepts was important since our CPE with only 50 anchor concepts still outperformed prior arts as illustrated in Table C.2 in the appendix.

${ }$

Table. Surrogate and anchor concepts for celebrities erasure

Table. Surrogate and anchor concepts for artistic styles erasure

Question 2. For NSFW erasure, CPE erased 4 concepts, "nudity, naked, eratic, sexual" similar with MACE. The more concepts that are deleted, the more effective the deletion tends to be. However, UCE, ESD, and RECE all remove only one word, "nudity", can the authors provide the results of removing only "nudity"?

Response: Yes, see the below table for the results of removing only "nudity", demonstrating that our proposed CPE still outperformed prior arts by achieving the fewest number of detected NSFW contents, while maintaining high preservation performance on COCO-30K. We have included this table as Table C.5 in Appendix C.4 (Line 1114-1122).

Table. Explicit Contents Removal (I2P prompts)

${ }$

Question 3. From Appendix D.2, the authors set negative prompts for celebrities erasure. Was this negative cue word used in all baselines during the experimental comparisons?

Response: Yes, we applied the same negative prompts to all the baselines for fair comparisons.