Growth Inhibitors for Suppressing Inappropriate Image Concepts in Diffusion Models

Thank you for the thoughtful and constructive feedback that helped us improve our work. In response to the issues you raised, we have made clarifications below.

Response to W1: The main topics of these four papers are improving the quality and content of prompts to enrich the details of the generated images. And the purpose of our work is to prevent the text-to-image diffusion model from generating inappropriate images. We think these four works are rarely relevant to our work and we believe that the most likely scenario to apply these four works to our task is to reduce the possibility of introducing unsafe information by refining the input prompt.

However, our GIE can even solve the problem that implicit unsafe prompts may lead to inappropriate images. Locating and identifying unsafe features in images from an image perspective, the growth inhibitors suppress the expression of these features, thereby avoiding the generation of unsafe images by both explicit and implicit unsafe prompts. Compared with purifying input prompts, our method further eliminates the generation of unsafe images.

We have added the content mentioned here in the related work section, as shown in Lines 150-153.

---

Response to W2: Since our GIE does not fine-tune the model, it will not affect the model's cognition and will not cause catastrophic forgetting. In the experiment, we verified the FID and CLIP scores to show that our GIE has almost no impact on the quality and semantics of the image (see Table 1).

We can analyze the damage to the model from the images generated by other methods. For example, ESD will replace the concept of nakedness with the concept of bed, and the person can no longer be seen in the picture (Figure 18). SalUn, an erasure method, is very affected by the training set. Since the people in many naked pictures are standing, the training is easy to overfit, resulting in the same posture as the people in the generated pictures.

• Inappropriate concepts may not be entirely independent of some "appropriate concepts."

We have considered this issue and showed that other concepts are related to the target concept in illustrative examples (such as Figures 1 and 3, where "nudity" is inevitably related to "person"). In fact, our method can resolve it in a better way than other methods by accurately locating and removing inappropriate concepts using the attention mechanism with minimal effect on other concepts (e.g., our method preserves the semantic concept "person", whereas other methods may replace "person" with other objects for nudity erasure).

---

Response to W3: For one concept, we only need to obtain its intermediate values and let GPT-4o label the desired suppression scales for images generated from 60 prompts (approximately $1, in 20 minutes) and then train a two-layer MLP (about 30 seconds). Therefore, the training cost of the GIE method is low. We have added th above information to Appendix D.

Dear Reviewer pwHp,

We are pleased to hear that you no longer have concerns. Thank you again for the time and effort you put into reviewing our paper.

Best regards,

Authors

Thank you for the thoughtful and constructive feedback that helped us improve our work. In response to the issues you raised, we have made clarifications below.

Response to W1: Thanks for the helpful comments. Based on these comments, we have added Appendix A to provide a detailed justification of the proposed method and Appendix B to carry out ablation studies on the injection position of growth inhibitors in the revised paper.

• Clarification on reweighted attention map and growth inhibitor: As shown in previous studies [3,4,5], the attention map contains the image features that need to be paid attention to, and different values in the attention map signify the importance of different pixels. To locate the region of attention corresponding to the target concept $p^*$, we obtain its attention map group $M^*$. If we multiply the target attention map by a negative weight, we can turn the region that requires more attention into the region that needs more suppression. Therefore, the attention maps after multiplying the negative weight can be considered growth inhibitors.
• Rationale behind the insertion of attention map for concept erasure: The elements in the attention map group are mapped with the elements in the text embedding one-to-one. Different from the information in the text embedding that is affected by order (see [1,2], the transformer structure allows the subsequent token to contain the information of the previous token), the attention maps obtained interact with each other in Unet and jointly affect the generation of images. For this reason, additional injected image features (growth inhibitors) can also play a role in the generation process and guide it in the opposite direction. We conducted an experiment to further illustrate the above point. Let the prompt be "a happy woman and a sad man" and encode it, we swap the corresponding positions of "happy" and "sad" in its text embedding and generate an image, and find that the result is exactly the same as the original image, as shown in Figure 9. This proves that the order of each item in the text embedding does not affect the generated result and jointly affects the generated results. Therefore, we can infer that the additionally introduced attention maps (growth inhibitors) will also work together with the original attention maps during image generation.
• The meaning of new attention maps in M_replace: $M_{replace}$ obtained after adding the growth inhibitor replaces the original $M$ and enters the subsequent procedure. After clarifying the above content, we can infer that the position to inject growth inhibitors has little effect on the result. Here we inject it between [SOT] and [EOT] to retain their original role of indicating the beginning and end of the text sequence, and we choose the position preceding [EOT] for ease of implementation.

---

Response to W2: The proposed adaptor demonstrates a certain level of generalizability. For example, after learning the inhibition level of cats, it can be extended to the erasure task of dogs. This may be attributed to the substantial similarities in recognizable image features shared between the two tasks.

Specifically, the adapter effectively learns a mapping function that correlates intermediate values to suppression scales. Here, the intermediate values are derived from the image features pertinent to the target concept, while the suppression scales serve to re-weight these image features. Taking the task of erasing the concept of "nude" as an example, despite differences in the original prompts, our intermediate values all come from $m^*_{nude}$, which contain a large number of image features of the target concept. We found that these image features are associated with the suppression scales and this association can be captured by the adapter (as illustrated in Figure 3).

For target concepts exhibiting significantly different characteristics, the generalizability may be limited. In this case, we recommend adding this new target concept and retraining the MLP. In the future, it may be beneficial to explore using a more sophisticated model to address this issue. However, for our current erasure tasks, such as NSFW and style, the two-layer MLP is sufficient in most cases.

We are pleased to receive your feedback and questions, and thank you for your efforts and time. We have made clarifications below.

Response to Q1: The order of words in the prompt is important for the generated image, while the order of tokens in the text embedding is irrelevant for the generated image. So higher-quality models with better text encoders come to the same conclusion.
Let's use an example for illustration. If we encode $p_1$= "a happy woman and a sad man" to $c_1$ and encode $p_2$ = "a sad woman and a happy man" to $c_2$, $c_{happy}$ in $c_1$ and $c_2$ is different because the order of words affects the text encoder's results. And the $image_1$ obtained by $p_1$ and the $image_2$ obtained by $p_2$ are different. If we encode $p_1$ = "a happy woman and a sad man" to $c_1$ , and we swap the positions of $c_{happy}$ and $c_{sad}$ in $c_1$ to obtain $c_3$. Since the content in $c_{happy}$ does not change but only its position is changed, the image results of the $c_1$ and $c_3$ are consistent.

---

Response to Q2: The fact that the order does not matter has nothing to do with the effect of erasing concepts, but only serves to illustrate that we can insert the growth inhibitor at any position. The reason for the concept erasure effect is that we obtain the growth inhibitor and inject it into the attention map group of the original prompt. The attention maps in the attention map group reflect the image features that need to be paid attention to, and collectively shape the resulting image. Therefore, the growth inhibitors (which can be seen as attention maps) we inject enable unsafe features in the image to be fully discovered and suppressed by weighted negative values and affect the generated image together with the attention map group of the original prompt.

---

Response to Q3: Using the CLIP model to detect whether the target object is in the image is indeed a widely adopted method [1,2]. This is because CLIP is a zero-shot pre-trained model with high accuracy.

• If there is another object in the image, is it possible that the target object exists but does not look most similar to the image?

Yes, it is possible. This is related to the accuracy of the classification model. We cannot guarantee that the classification model can achieve 100% recognition accuracy.

• If there are multiple objects or if the concept is erased and no object exists, wouldn't the result be a uniform distribution?

Multiple objects exists: Since the prompt template for generating images only contains one class, there will not be multiple categories of objects in the image, and multiple objects of the same category can also be recognized by our method.

No objects exists: Sorry that our explanation is not clear enough and we add more details about object recognition. After computing cosine similarity between the the image with no object and 10 prompts ("a photo of a [class]"), we obtain 10 lower results (such as [24.271, 24.272, 24.273, 24.274, 24.275, 24.276, 24.277, 24.278, 24.279, 24.274]), which will enter the softmax to obtain 10 specific category probabilities ([0.0996, 0.0997, 0.0998, 0.0999, 0.1000, 0.1001, 0.1002, 0.1003, 0.1004, 0.0999]). If the highest category probability (0.1004) is lower than the threshold, we imply that objects in the image have been erased.

---

Reference:

[1] Lyu, Mengyao, et al. "One-dimensional Adapter to Rule Them All: Concepts Diffusion Models and Erasing Applications." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024.

[2] Kumari, Nupur, et al. "Ablating concepts in text-to-image diffusion models." Proceedings of the IEEE/CVF International Conference on Computer Vision. 2023.

Thank you for your constructive response.

A few remaining questions:

• If text order does not matter, could this issue stem from limitations in the text embedding's ability to consider order? Would higher-quality models with better text encoders yield different results?
• I didn’t quite understand how the fact that order does not matter relates to the insertion of the attention map to erase a concept.
• Perhaps I missed your point, but regarding your explanation of CLIP usage, isn’t it possible that the target object exists but doesn’t appear as the most similar to the image if there is another object in the image? Also, if there are multiple objects or if the concept is erased and no object exists, wouldn’t the result be a uniform distribution? In such cases, the target object might or might not be the most similar (Random max similarity). I wonder whether this is a widely adopted method.

Thank you for the thoughtful and constructive feedback that helped us improve our work. In response to the issues you raised, we have made clarifications below.

Response to W1: Thanks for the helpful comment. In the revised paper, we have added Appendix A to provide a detailed clarification of the injection position of growth inhibitors and carried out ablation studies in Appendix B.

• Clarification on the position of Growth Inhibitors (Appendix A).

In general, due to the attention mechanism in the Unet of the diffusion model, the additional attention maps (growth inhibitors) can work together with the original attention maps during image generation, and thus the location where Growth Inhibitors are injected has no obvious effect on the erasure results. We can inject it anywhere between [SOT] and [EOT] so that [SOT] and [EOT] still indicate the beginning and end positions of the text sequence. And we chose the position preceding [EOT] for ease of implementation.

• Ablation study on the position of Growth Inhibitors (Appendix B).

The above clarification is further confirmed by the ablation study in Appendix B. For the task of erasing the concept of "nude", we compare the results of GIE when injecting growth inhibitors in different positions (before $m_\text{[EOT]}$, after $m_{\text{[SOT]}}$, and at a random position). We show the NRR results on the I2P dataset as follows (see also Figure 10 in Appendix B) and find that these three variants yield the same erasing effects.

---

Response to W2: Thanks for the comment on our experiments. We have conducted additional quantitative and qualitative experiments for multi-concept erasing in Appendix F of the revised paper.

• Quantitative experimentation on multi-concept erasing

To erase the two concepts "nude" and "Van Gogh" simultaneously, we generate 200 images using "a painting of a nude person in Van Gogh Style" and use NudeNet to detect the exposed parts. As shown in the following table (see also Figure 14 in Appendix F), we have almost completely erased the concept of "nude". Subsequently, we use GPT-4o to classify the styles of these two hundred images and find that only three images are classified as Van Gogh style. This shows the effectiveness of our approach in maintaining the superior erasing effect for multiple concepts.

• Qualitative results for more than 2 concept erasing.

We also show the generated examples when erasing more than two concepts in Figure 15 of the revised paper. We discussed multi-concept erasing across three scenarios and showed that GIE achieved excellent erasure results in all these scenarios:
(1) The image contains all the target concepts.
Example 1: prompt = "This is a Van Gogh style painting of a dog and a cat playing with a naked woman on the beach."; target concepts= "Van Gogh", "nude", "dog", "cat".
(2) The image contains some of the target concepts.
Example 2: prompt = "This is a Van Gogh style painting of a naked woman on the beach."; target concepts="Van Gogh", "nude", "dog", "cat".
Example 3: prompt = "This is a Van Gogh style painting of a naked woman on the beach."; target concepts= "nude", "dog", "cat", "bike".
Example 4: prompt = "This is a Van Gogh style painting of a naked woman on the beach.v; target concepts= "Van Gogh", "dog", "cat".
(3) The image does not contain any target concepts.
Example 5: prompt = "This is a Van Gogh style painting of a naked woman on the beach."; target concepts="dog", "cat", "bike".

Dear Reviewer yvQD,

Many thanks for your efforts in reviewing this paper. Your careful reading and insightful comments indeed help us a lot in improving this paper. We have provided responses to your questions and the weaknesses you mentioned. We hope this can address your concerns.

If our responses satisfactorily address your concerns, we would like to kindly ask if you could consider raising the score. If not, please let us know any remaining questions you may have. We look forward to hearing from you soon.

Best regards,

Authors

Dear Reviewer yvQD,

Sorry to bother you again. We would like to know whether the responses have addressed your concerns.

If you have any remaining questions or require further clarification, we would be more than happy to provide additional details. If our responses satisfactorily address your concerns, we would like to kindly ask if you could consider raising the score.

Your support would mean a great deal to us and would greatly encourage our continued efforts in this area. Thank you once again for your time, effort, and constructive comments!

Best regards,

Authors

Thank you for the thoughtful and constructive feedback that helped us improve our work. In response to the issues you raised, we have made clarifications below.

Response to W1Q1: In our method, [SOT] and [EOT] are used as structure markers to indicate the beginning and end of a text sequence, respectively. We have explained this in Lines 249-250 of the revised paper.

Response to W1Q2: In our method, the starting and ending positions for feature extraction are determined by the positions of $m^*_{[SOT]}$ and $m^*_{[EOT]}$. Specifically, let the position of $m^∗_{[SOT]}$ in $M^*$ be $s$ and the position of $m^∗_{[EOT]}$ be $e$, the starting and end positions for extraction are $s + 1$ and $e − 1$, respectively. We clarify this in Lines 264-265 of the revised paper.

---

Response to W2: Thanks for the comment on our experiments. We have performed additional ablation studies on the adapter and the insertion position of the growth inhibitors in Appendices C and B, respectively.

• The ablation study on the adapter (see Appendix C for details) has shown that the adapter can help better balance the erasure effect and semantic preservation. Specifically, we have compared the effects of erasing the concept "nude" with a fixed suppression scale and when erasing it using our adapter. The tables below (see also Figure 11 and Table 3 in Appendix C) present the NRR and CLIP scores on the I2P dataset. Although the NRR results are better when the suppression scale w = 10, this comes at the expense of significant semantic distortion, as indicated by the CLIP scores. Meanwhile, the CLIP score with the suppression scale w = 5 is very close to GIE with the adapter, but the erasing effect is inferior. Moreover, the visual examples provided in Figure 12 also show results with different fixed suppression scales.

• The ablation study on the insertion position (see Appendix B for details) reveals that the three positions (before $m_{[EOT]}$, after $m_{[SOT]}$, and at a random position) exhibit comparable erasing effects. Specifically, we investigate the task of erasing the concept of "nude" by comparing the performance of the Growth Inhibitor for Erasure (GIE) when injected at these three different positions. The NRR results on the I2P dataset are presented in the following table (see also Figure 10 in Appendix B). We attribute this similarity in erasing effectiveness to the collective influence of all attention maps within the Unet on the generated results, which remain invariant to the order of insertion. Further explanations can be found in Appendix B.

Dear Reviewer S8KB,

Many thanks for your efforts in reviewing this paper. Your careful reading and insightful comments indeed help us a lot in improving this paper. We have provided responses to your questions and the weaknesses you mentioned. We hope this can address your concerns.

If our responses satisfactorily address your concerns, we would like to kindly ask if you could consider raising the score. If not, please let us know any remaining questions you may have. We look forward to hearing from you soon.

Best regards,

Authors