Fantastic Targets for Concept Erasure in Diffusion Models and Where To Find Them

Are there any human evaluations of artistic style?

In Section 5.3 of the paper (the section on erasing artistic styles), we clearly clarified that human evaluation was avoided due to its high cost, time-consuming nature, lack of scalability, and, more importantly, susceptibility to bias. Instead, we utilized the CLIP alignment score and the LPIPS score to evaluate erasure performance, as these metrics have also been employed in previous works [1, 2].

However, to fully address this concern, we have conducted an additional experiment to collect human evaluation results on the artistic style erasure task. The anonymous link to the survey is provided below, and we will include more details in the final version of the paper. However, we must admit that due to the high cost, the survey is limited to 50 images across all five artists per method, which might not be large enough to draw a solid conclusion.

Anonymous link to the survey: https://forms.gle/SyUV3e95d7NWpdW77

[1] Gandikota, Rohit, et al. "Unified concept editing in diffusion models." WACV 2024.

[2] Heng, Alvin, and Harold Soh. "Selective amnesia: A continual learning approach to forgetting in deep generative models." NeurIPS 2023.

The proposed method doesn't achieve the SOTA, like Table 3. Any detailed discussion about this?

It is worth noting that we conducted three erasure tasks in the paper: erasing physical objects, NSFW attributes, and artistic styles. We achieved state-of-the-art (SOTA) performance in two of these tasks (physical objects and NSFW attributes), significantly surpassing the recent SOTA method (MACE, CVPR 2024) in the object erasure task and closely matching the performance of the foundation model.

For the artistic style erasure task, a key challenge lies in the lack of a reliable detector for identifying the presence of artistic styles in generated images. To address this, we utilized the CLIP alignment score and the LPIPS score as evaluation metrics, which have also been employed in prior works. However, these metrics are not perfect and cannot reliably detect artistic styles. Consequently, compared to the other two tasks, the results of the artistic style erasure task should be interpreted as a complementary perspective.

Given that metric limitations in mind, from the experimental results in Table 3, it is evident that no single method clearly outperforms all others. For instance, while the MACE method achieves the best preservation performance, it performs worst in terms of erasure. Conversely, the ESD method secures the second-best erasure performance (based on the CLIP alignment score) but exhibits the poorest preservation performance. Our method strikes a better balance between preservation and erasure performance than all other methods. Specifically, with comparable preservation performance, our method outperforms UCE in erasure. Similarly, with comparable erasure performance, it surpasses ESD and CA in preservation. We will clarify this further in the final version of the paper.

The results of the experiment are shown in the following table. We investigate three different vocabularies for the concept space $\mathcal{C}$ in the experiment including the ImageNet (AGE-I), Oxford-3K (AGE-O), and the manually crafted vocabulary (AGE-M), where we leverage the knowledge of the to-be-erased concepts to generate the vocabulary, i.e., which words are semantically related to the to-be-erased concepts, like "dog", "car", "instrument", etc. This manually crafted vocabulary is similar to the Oxford-3K but much smaller in size. We compare the performance of AGE with the ESD and UCE methods.

Compared to the baseline methods, it can be seen that UCE totally fails when the number of concepts increases. Our AGE method with Oxford-3K vocabulary (AGE-O) outperforms the ESD method in both erasure and preservation performance. Compared among the three vocabularies, it can be seen that while AGE-O outperforms other vocabularies in erasure performance, it has significant performance drop in preservation performance. The AGE method with manually crafted vocabulary (AGE-M) achieves the best trade-off between erasure and preservation performance, which has a small drop in erasure performance compared to ESD but a much better preservation performance, which is consistent with our analysis in Section 3.2.

The approach's effectiveness relies on the accuracy of the concept graph's structure. Any inaccuracies in capturing semantic relationships may affect erasure outcomes. Is there any discussion regarding this?

We thank the reviewer for raising this interesting question.

Powerful generative models like Stable Diffusion are trained on massive text-image datasets, such as the LAION-5B dataset. As a result, the number of concepts that these models can generate is extremely large. Consequently, constructing a complete concept graph that connects all these concepts is exponentially complex and practically impossible to achieve accurately.

To address this, our method relies on a concept space $\mathcal{C}$ that contains only a subset of all possible concepts. This concept space can be thought of as a vocabulary, enabling us to represent a concept as a combination of multiple elements from this vocabulary. By doing so, we can enhance the richness and expressiveness of the concepts while significantly reducing computational costs.

From our perspective, the concept space $\mathcal{C}$ is the most crucial part of our method. We have provided a thorough analysis of how the concept space is chosen in Appendix D.5.

We thank the reviewer for acknowledging our strengths and providing constructive comments. We would like to address the remaining concerns as follows:

The optimization procedure for selecting target concepts may be computationally demanding for models with large concept spaces, which could limit AGE's scalability in practice.

We would like to address the scalability concern of our method from two aspects: computational complexity analysis and empirical evaluation.

Computational Complexity Analysis

Firstly, we would like to remind that we have already acknowledged this computational challenge in Appendix B in the paper. More specifically, a crucial aspect of our method is the concept space $\mathcal{C}$, which is used to search for the optimal target concept. As discussed in Section 4 and further detailed in Appendix B, we use the Gumbel-Softmax trick, which requires feeding the model with the embedding matrix $T_\mathcal{C}$ of all concepts in the concept space $\mathcal{C}$. However, this requires a large computational cost, especially when the concept space $\mathcal{C}$ is large. To mitigate the issue, we use a small set of concepts $\mathcal{C}_{c_e}$ which contains the most $k$ closest concepts to the concept $c_e$ in the original concept space $\mathcal{C}$ for each concept, $c_e$ to reduce the computational cost. We simply choose $k=100$ for all experiments.

Since we erase multiple concepts simultaneously, each concept $c_e$ has an associated set of target concepts $\mathcal{C}_{c_e}$ to search for.

We maintain a dictionary to store the weight $\pi$ of the optimal target concept for each concept $c_e$. During each iteration, we first sample a concept $c_e$ and retrieve the previously stored weight $\pi_{c_e}$ from the dictionary. By doing so, we not only reduce the computational cost but also improve the optimization stability.

More specifically, the size of the embedding matrix $T_\mathcal{C}$ in each iteration is just $B \times k \times d$, where $B$ is the batch size, $k$ is the size of the search space and $d$ is the dimension of the embedding space. It can be seen that the embedding matrix (as well as the computational cost) does not grow with the size of the erasing set $\mathbf{E}$ but only depends on the batch size and the size of the search space. Overall, the computational cost of AGE is still acceptable, even for a large erasing set.

Empirical Evaluation on Scalability

We conduct an additional experiment to demonstrate/evaluate the scalability of our proposed method. More specifically, we erase 25 concepts from the NetFive dataset, simultaneously and collect additional 75 other concepts from the ImageNet dataset to form a set of 100 concepts for evaluation. In the preservation set of 75 concepts, we intentionally include 25 concepts that are semantically similar to the 25 concepts being erased and 50 other concepts that are semantically unrelated. We use the ImageNet hierarchy from this website https://observablehq.com/@mbostock/imagenet-hierarchy and Google search to find these visually semantically similar concepts. The code has been uploaded to the anonymous GitHub repository and the experiment details will be provided in the final version. Below, we show the breakdown of the concepts (to-be-erased and to-be-preserved-similar) used in the experiment.

Thanks for the authors' feedback.

Dear Reviewer BfS9,

Thank you for taking the time to read through our rebuttal. We would like to remind you that we are available to address any further questions or concerns you may have. If our response has adequately resolved your concerns, we kindly ask you to consider updating your rating.

We sincerely appreciate your constructive feedback and thoughtful review, which undoubtedly helped us improve the quality of our work.

Best regards,

The Authors

The general techniques and ideas appear as not very complex or novel (rather an application of related ideas, e.g. classic graph-based approaches) to new problems.

We respectfully disagree with this comment. We believe that our paper makes three main contributions that are both innovative and provide new insights into the problem of concept erasure.

The first contribution is a novel empirical evaluation of the structure and geometric properties of the concept space, offering fresh perspectives on concept erasure. This includes key insights such as the localized impact of erasing one concept on another.

The second major contribution is our study of the impact of target concept selection on both erasure effectiveness and the preservation of benign concepts. In this study, we identify two key properties of desirable target concepts. To the best of our knowledge, this work is the first to systematically explore the structure of the concept space and analyze the effect of target concept selection on the erasure task. We believe these observations can provide new insights into the design of future concept erasure methods.

The third contribution is the introduction of the AGE method, which is the first approach capable of dynamically selecting the optimal target concept for each undesirable concept. We view the simplicity and effectiveness of our method as a strength rather than a weakness.

These contributions have been acknowledged by all other reviewers, as well as in your comment recognizing our strengths: "Clever and intuitive knowledge graph-based approach, clear and well-motivated storyline for the proposed objective."

The presentation of results could be a bit clearer to show more of where gains come from. For instance, in Table 1, it seems no other method comes close to the proposed one. I would love to better understand why this is?

We thank the reviewer for acknowledging the superiority of our method. The significant performance improvement stems from our method's ability to dynamically select the optimal target concept for each undesirable concept, whereas other methods must rely on a fixed target concept for all undesirable concepts.

These target concepts are chosen based on the key observation we comprehensively discuss in Section 3 of the paper. Specifically, we observe that the erasure effect is localized. Thus, the target concept should be semantically related to the concept being erased but not semantically similar to other concepts.

With this observation in mind, we designed our method to dynamically select the optimal target concept for each undesirable concept by solving a minimax optimization problem, as detailed in Section 4. The target concepts identified by our method exhibit the desired properties, as discussed in Appendix D.5.

We will clarify this further in the final version of the paper.

How should we think how the granularity of concepts impacts the proposed method?

We thank the reviewer for raising this interesting question.

First, we would like to clarify that granularity in this context refers to the level of detail or specificity used to define and categorize concepts. With this in mind, we identify two levels of granularity:

• Fine-grained concepts are highly specific and detailed, capturing subtle variations and attributes. For example, within the category "dog," fine-grained concepts include specific breeds such as "English Springer Spaniel" or "Clumber Spaniel."

• Coarse-grained concepts are more general and encompass broader categories. In the same example, "dog" itself would be a coarse-grained concept.

The empirical results from Section 3.2 (Choice of Target Concepts) suggest that an erasure method is more effective when the target concepts are fine-grained (closely related but non-synonymous).

The level of granularity is determined by the choice of concept space $\mathcal{C}$, rather than by the specifics of the erasure method. For instance, one can use the ImageNet label set, which contains 1,000 concepts of fine-grained categories, such as specific dog breeds. In contrast, the Oxford-3K dictionary, consisting of 3,000 common English words, is more coarse-grained with categories like "dog" instead of specific breeds. As a result, when erasing a specific concept such as "English Springer Spaniel", using ImageNet concept space is more effective because it includes more finely-grained concepts.

We discussed the impact of the choice of concept space in Appendix D.2. Specifically, we compare four concept spaces with different levels of granularity:

• ImageNet label set (fined-grain) includes specific concepts such as English Springer Spaniel, Clumber Spaniel.

• Oxford-3K dictionary (coarse-grain) contains broader categories such as dog, cat, focusing on common English words.

• CLIP vocabulary (coarse-grain) includes CLIP tokens such as dog, doggie, spaniel. Note that it also includes alphabet characters, subwords, and special tokens, which do not correspond to any meaningful concepts.

• Generated concept set (fined-grain) This concept set is generated by ChatGPT-3.5 and is made available in the anonymous GitHub repository, folder "concepts". It contains 100 target concepts per concept to be erased, such as American Foxhound, Beagle, providing a high level of granularity. However, many of these concepts are overly similar to the concept being erased.

The results in Table 4 in the paper (we also provide here for reading convenience) show that our method achieves the best preservation performance but the worst erasure performance with the ChatGPT-generated concepts. This aligns with our analysis in Section 3.2, as the target concepts are too semantically similar to the erased concept. On the other hand, the preservation performance is poorer when using overly coarse-grained vocabularies, such as the CLIP and Oxford-3K concept space.

Finally, erasing with the ImageNet concept space achieves the best erasure performance and the second-best preservation performance among all tested concept spaces. This indicates that it provides an effective balance between granularity and semantic similarity.

The results of the experiment are shown in the following table. We investigate three different vocabularies for the concept space $\mathcal{C}$ in the experiment including the ImageNet (AGE-I), Oxford-3K (AGE-O), and the manually crafted vocabulary (AGE-M), where we leverage the knowledge of the to-be-erased concepts to generate the vocabulary, i.e., which words are semantically related to the to-be-erased concepts, like "dog", "car", "instrument", etc. This manually crafted vocabulary is similar to the Oxford-3K but much smaller in size. We compare the performance of AGE with the ESD and UCE methods.

Compared to the baseline methods, it can be seen that UCE totally fails when the number of concepts increases. Our AGE method with Oxford-3K vocabulary (AGE-O) outperforms the ESD method in both erasure and preservation performance. Compared among the three vocabularies, it can be seen that while AGE-O outperforms other vocabularies in erasure performance, it has significant performance drop in preservation performance. The AGE method with manually crafted vocabulary (AGE-M) achieves the best trade-off between erasure and preservation performance, which has a small drop in erasure performance compared to ESD but a much better preservation performance, which is consistent with our analysis in Section 3.2.

We thank the reviewer for acknowledging our strengths and providing constructive comments. We would like to address the remaining concerns as follows:

How does the approach scale with the number of concepts?

We would like to address the scalability concern of our method from two aspects: computational complexity analysis and empirical evaluation.

Computational Complexity Analysis

Firstly, we would like to remind that we have already acknowledged this computational challenge in Appendix B in the paper. More specifically, a crucial aspect of our method is the concept space $\mathcal{C}$, which is used to search for the optimal target concept. As discussed in Section 4 and further detailed in Appendix B, we use the Gumbel-Softmax trick, which requires feeding the model with the embedding matrix $T_\mathcal{C}$ of all concepts in the concept space $\mathcal{C}$. However, this requires a large computational cost, especially when the concept space $\mathcal{C}$ is large. To mitigate the issue, we use a small set of concepts $\mathcal{C}_{c_e}$ which contains the most $k$ closest concepts to the concept $c_e$ in the original concept space $\mathcal{C}$ for each concept, $c_e$ to reduce the computational cost. We simply choose $k=100$ for all experiments.

Since we erase multiple concepts simultaneously, each concept $c_e$ has an associated set of target concepts $\mathcal{C}_{c_e}$ to search for.

We maintain a dictionary to store the weight $\pi$ of the optimal target concept for each concept $c_e$. During each iteration, we first sample a concept $c_e$ and retrieve the previously stored weight $\pi_{c_e}$ from the dictionary. By doing so, we not only reduce the computational cost but also improve the optimization stability.

More specifically, the size of the embedding matrix $T_\mathcal{C}$ in each iteration is just $B \times k \times d$, where $B$ is the batch size, $k$ is the size of the search space and $d$ is the dimension of the embedding space. It can be seen that the embedding matrix (as well as the computational cost) does not grow with the size of the erasing set $\mathbf{E}$ but only depends on the batch size and the size of the search space. Overall, the computational cost of AGE is still acceptable, even for a large erasing set.

Empirical Evaluation on Scalability

We conduct an additional experiment to demonstrate/evaluate the scalability of our proposed method. More specifically, we erase 25 concepts from the NetFive dataset, simultaneously and collect additional 75 other concepts from the ImageNet dataset to form a set of 100 concepts for evaluation. In the preservation set of 75 concepts, we intentionally include 25 concepts that are semantically similar to the 25 concepts being erased and 50 other concepts that are semantically unrelated. We use the ImageNet hierarchy from this website https://observablehq.com/@mbostock/imagenet-hierarchy and Google search to find these visually semantically similar concepts. The code has been uploaded to the anonymous GitHub repository and the experiment details will be provided in the final version. Below, we show the breakdown of the concepts (to-be-erased and to-be-preserved-similar) used in the experiment.

Dear Reviewer TuUt,

Thank you for taking the time to read through our rebuttal. We greatly appreciate your positive feedback on our work and are pleased that our response has adequately addressed your concerns.

Once again, we sincerely thank you for your time and effort in reviewing our paper.

Best regards, The Authors

Dear Reviewer eC2n,

We would like to remind you that we have provided a detailed rebuttal to your concerns in the previous section, which we are pleased to note has been appreciated by Reviewer TuUt. We are also available to address any further questions or concerns you may have. If our response has adequately resolved your concerns, we kindly ask you to consider updating your rating.

We sincerely appreciate your constructive feedback and thoughtful review, which have undoubtedly helped us improve the quality of our work.

Best regards, The Authors

Empirical Evaluation on Scalability

We conduct an additional experiment to demonstrate/evaluate the scalability of our proposed method. More specifically, we erase 25 concepts from the NetFive dataset, simultaneously and collect additional 75 other concepts from the ImageNet dataset to form a set of 100 concepts for evaluation. In the preservation set of 75 concepts, we intentionally include 25 concepts that are semantically similar to the 25 concepts being erased and 50 other concepts that are semantically unrelated. We use the ImageNet hierarchy from this website https://observablehq.com/@mbostock/imagenet-hierarchy and Google search to find these visually semantically similar concepts. The code has been uploaded to the anonymous GitHub repository and the experiment details will be provided in the final version. Below, we show the breakdown of the concepts (to-be-erased and to-be-preserved-similar) used in the experiment.

The results of the experiment are shown in the following table. We investigate three different vocabularies for the concept space $\mathcal{C}$ in the experiment including the ImageNet (AGE-I), Oxford-3K (AGE-O), and the manually crafted vocabulary (AGE-M), where we leverage the knowledge of the to-be-erased concepts to generate the vocabulary, i.e., which words are semantically related to the to-be-erased concepts, like "dog", "car", "instrument", etc. This manually crafted vocabulary is similar to the Oxford-3K but much smaller in size. We compare the performance of AGE with the ESD and UCE methods.

Compared to the baseline methods, it can be seen that UCE totally fails when the number of concepts increases. Our AGE method with Oxford-3K vocabulary (AGE-O) outperforms the ESD method in both erasure and preservation performance. Compared among the three vocabularies, it can be seen that while AGE-O outperforms other vocabularies in erasure performance, it has significant performance drop in preservation performance. The AGE method with manually crafted vocabulary (AGE-M) achieves the best trade-off between erasure and preservation performance, which has a small drop in erasure performance compared to ESD but a much better preservation performance, which is consistent with our analysis in Section 3.2.

Question: Have you tested the AGE method on other types of diffusion models or generative models? If so, what were the results, and if not, what are the anticipated challenges?

Our empirical investigation on the impact of the concept space, presented in Section 3, is based on the Stable Diffusion v1.4 and v2.1 models, with the full results provided in Appendix D.1. The experiments evaluating the AGE method are conducted on the Stable Diffusion v1.4 model, which is the standard setting in the literature.

To further validate the effectiveness of our method, we are conducting additional experiments on Stable Diffusion v2.1. However, due to time and resource constraints, these experiments have not yet been completed. We will update the results in the final version of the paper.

For generative models other than diffusion models, such as GANs or VAEs, we anticipate that the AGE method can be applied similarly. This is because our approach relies on the output of the generative model, which is consistent across all types of text-to-image generative models as long as they are conditioned on textual input. However, we leave a thorough exploration of these models for future work.

Weakness: Evaluation Metrics: A more comprehensive discussion on the choice and limitations of the evaluation metrics used would strengthen the validation of the method's effectiveness.

To evaluate the performance of a concept erasure method, the primary task is to detect the presence of the concept in the generated image. While this detection task might appear straightforward, the challenge lies in the lack of a universal detector capable of reliably identifying all concepts. As a result, the choice of detector depends on the specific task.

For example, in the object erasure task, we intentionally select concepts from the ImageNet dataset, allowing us to leverage pre-trained classifiers such as ResNet-50. For the NSFW attribute erasure task, we use the NudeNet detector, which is widely adopted in the literature. The most challenging task is artistic style erasure, for which no existing detector is available. In this case, we rely on the CLIP alignment score and the LPIPS score as evaluation metrics, both of which have been used in prior works [1, 2].

We will clarify this further in the final version of the paper.

[1] Gandikota, Rohit, et al. "Unified concept editing in diffusion models." WACV 2024.

[2] Heng, Alvin, and Harold Soh. "Selective amnesia: A continual learning approach to forgetting in deep generative models." NeurIPS 2023.

Weakness: Scalability: The scalability of the minimax optimization approach for large concept spaces is not fully addressed. Discussing computational complexity and optimization strategies would be helpful

We would like to address the scalability concern of our method from two aspects: computational complexity analysis and empirical evaluation.

Computational Complexity Analysis

Firstly, we would like to remind that we have already acknowledged this computational challenge in Appendix B in the paper. More specifically, a crucial aspect of our method is the concept space $\mathcal{C}$, which is used to search for the optimal target concept. As discussed in Section 4 and further detailed in Appendix B, we use the Gumbel-Softmax trick, which requires feeding the model with the embedding matrix $T_\mathcal{C}$ of all concepts in the concept space $\mathcal{C}$. However, this requires a large computational cost, especially when the concept space $\mathcal{C}$ is large. To mitigate the issue, we use a small set of concepts $\mathcal{C}_{c_e}$ which contains the most $k$ closest concepts to the concept $c_e$ in the original concept space $\mathcal{C}$ for each concept, $c_e$ to reduce the computational cost. We simply choose $k=100$ for all experiments.

Since we erase multiple concepts simultaneously, each concept $c_e$ has an associated set of target concepts $\mathcal{C}_{c_e}$ to search for.

We maintain a dictionary to store the weight $\pi$ of the optimal target concept for each concept $c_e$. During each iteration, we first sample a concept $c_e$ and retrieve the previously stored weight $\pi_{c_e}$ from the dictionary. By doing so, we not only reduce the computational cost but also improve the optimization stability.

More specifically, the size of the embedding matrix $T_\mathcal{C}$ in each iteration is just $B \times k \times d$, where $B$ is the batch size, $k$ is the size of the search space and $d$ is the dimension of the embedding space. It can be seen that the embedding matrix (as well as the computational cost) does not grow with the size of the erasing set $\mathbf{E}$ but only depends on the batch size and the size of the search space. Overall, the computational cost of AGE is still acceptable, even for a large erasing set.

We thank the reviewer for the positive feedback and constructive comments. We would like to address the remaining concerns as follows:

Question: How does the method ensure that the erasure of a concept does not inadvertently affect semantically related but benign concepts?

We thank the reviewer for raising this interesting question.

Intuitively, as observed in Section 3, the concept space can be visualized as a graph where each node represents a concept, and edges between nodes represent the impact between concepts. Mapping one concept ($c_e$) to another ($c_t$) by minimizing the erasing loss, as described in Eq. 3 of our paper, can be understood as pulling the node $c_e$ closer to the node $c_t$ on this graph. This action triggers a chain reaction, where the erasure effect spreads out—strongly impacting locally related concepts and weakly affecting those further away or unrelated.

In the naive approach, the target concept $c_t$ is a neutral concept semantically distant from the concept to be erased ($c_e$). This leads to a stronger chain reaction effect. In contrast, our proposed approach adaptively selects $c_t$ to be semantically related to, but not synonymous with, $c_e$. This strategy minimizes the chain reaction effect. As discussed in Section 3.2, where we compare different target selection strategies—including those involving semantically related but benign concepts—the results show that the erasure impact is smaller with these in-class target concepts than with the naive strategy. These findings align well with our analysis.

To further evaluate the impact on semantically related but benign concepts, we conducted an additional experiment. Specifically, we erased 25 concepts from the NetFive dataset and selected additional 75 concepts from the ImageNet dataset for the preservation set. Within this preservation set, we intentionally included 25 concepts that are semantically similar to the concepts being erased, along with 50 semantically unrelated concepts.

We use the ImageNet hierarchy from this website https://observablehq.com/@mbostock/imagenet-hierarchy and Google search to find these visually semantically similar concepts. The code has been uploaded to the anonymous GitHub repository and the experiment details will be provided in the final version. Below, we show the breakdown of the concepts (to-be-erased and to-be-preserved-similar) used in the experiment.

The results show that our method, using the ImageNet vocabulary (AGE-I) and the manually crafted vocabulary (AGE-M), achieve the best preservation performance. Both variants exhibit only a small drop in generation capability for semantically related but benign concepts while significantly outperforming the baseline methods.

Among our variants, the worst-performing is AGE-O, which uses the Oxford-3K vocabulary. Nevertheless, AGE-O still outperforms the ESD method in preserving the tested concepts.

Results on Stable Diffusion v2.1

We follow the reviewer's suggestion and evaluate the AGE method on Stable Diffusion v2.1. We follow the same experimental settings as in Section 5.1 of the paper. More specifically, we conduct four different experiments, each involving the simultaneous erasure of five classes from the Imagenette dataset while preserving the remaining five classes, generating 500 images per class. While we can successfully deploy the ESD method on Stable Diffusion v2.1, we are unable to do the same for the UCE method because of a implementation issue. All the code has been uploaded to the anonymous GitHub repository.

It can be seen from table below that our method achieves significant improvements over the ESD method in both erasure and preservation performance, with a gain of 2.5% in ESR-5 and 8% in PSR-5. This indicates the generalizability of our method on different generative models.

We will add the results in the final version of the paper.