CGCE: Classifier-Guided Concept Erasure in Generative Models

AI summary

Overview

Research area: Computer vision and generative model safety — specifically concept erasure (removing unwanted concepts such as nudity, artistic styles, or objects) from text-to-image (T2I) and text-to-video (T2V) diffusion and autoregressive models.

Technical level: Advanced. The paper builds on text-encoder geometry (CLIP vs. T5), cross-attention, classifier-free guidance, and gradient-based embedding refinement.

Scope: The paper proposes CGCE, a plug-and-play, weight-preserving framework that detects unsafe concepts in text embeddings with a lightweight classifier and then refines those embeddings so that unsafe generations are blocked while safe generations remain untouched.

What This Paper Is About

Generative models can be prompted to produce unsafe content, and existing concept-erasure methods either permanently retrain model weights (hurting image quality), or intervene at inference time in ways that adversarial red-teaming attacks can bypass. CGCE's goal is robust erasure of an undesired concept across many different generative architectures — without modifying the original model weights and without degrading quality on unrelated, safe prompts.

Key Contributions

1. A plug-and-play, image-free framework. CGCE trains a lightweight classifier on synthetic paired prompts and uses it both to detect unsafe concepts in text embeddings and to refine them, requiring no change to the generative model's weights and no image data during training.
2. State-of-the-art safety with preserved utility. The method reports leading results on multiple benchmarks while keeping FID and CLIP scores nearly identical to the unmodified base model, which the authors frame as a better safety–utility trade-off than fine-tuning methods.
3. Architecture and modality generalization. CGCE is demonstrated on diverse modern T2I models (SD-v1.4, SD-v2.1, SD-v3, FLUX.1-dev, Infinity-2B, Switti-AR) and T2V models (CogVideoX-2B, CogVideoX-5B, HunyuanVideo), where a classifier trained on CLIP embeddings serves CLIP-based models and one trained on T5 embeddings serves T5-based models.
4. A diagnosis of why prior token-level projection fails. The paper analyzes SAFREE's limitations with the T5 text encoder, attributing the failure to T5's anisotropic, entangled embedding space rather than to a mere thresholding flaw.

Main Findings

• Nudity removal on SD-v1.4 (Table 2): CGCE reports ASR of 4.62 (I2P), 2.47 (SixCD), 4.41 (P4D), 3.87 (RAB), 1.90 (MMAD), and 27.46 (UDA), with FID 16.10 and CLIP 31.03. The unmodified SD-v1.4 baseline scores 36.41, 82.13, 75.74, 97.19, 63.60, 97.18, with FID 16.79 and CLIP 31.31.
• Ranking across six benchmarks: CGCE ranks first on four of six nudity benchmarks (SixCD, P4D, RAB, MMAD) and second-best on I2P and UDA. On I2P, STEREO is lower (0.75) but shows a utility drop (FID 17.98, CLIP 30.16); on UDA, SLD-Max is lower (21.83) but with FID 26.63.
• Outperforming the other training-free embedding method: CGCE beats SAFREE on every nudity benchmark (SAFREE: I2P 12.35, SixCD 39.18, P4D 48.90, RAB 74.74, MMAD 44.70, UDA 80.99, FID 19.55, CLIP 30.69).
• Van Gogh style removal (Table 3): CGCE achieves LPIPS_e 0.43, LPIPS_u 0.00, LPIPS_d 0.43, and ASR 0.00 — the best reported, with zero measured impact on unrelated styles.
• Van Gogh and Church removal under UDA (Table 4): CGCE reaches ASR 24.00 for Van Gogh and 16.00 for Church, with FID 16.79 and CLIP 31.31 / 31.29, versus SD-v1.4 at 100.00 and 98.00.
• Generalization across T2I backbones (Table 5): On FLUX, CGCE cuts RAB ASR to 0.70 from a 97.19 baseline, while SAFREE only reaches 87.89 and EraseFlow 41.75. On SD-v3, CGCE achieves 0.40 on MMAD versus 25.20 for the base model. On Switti-AR and Infinity-2B, CGCE also outperforms SAFREE across all five attack benchmarks.
• Generalization to T2V (Table 6): On HunyuanVideo, CGCE records 6.53 (Gen) and 4.82 (SafeSora-Sexual) versus 59.87 and 21.27 for the base model and 9.18 / 5.25 for T2VU. Similar gains are reported for CogX-2B (3.67 / 1.48) and CogX-5B (3.02 / 0.86).
• Classifier accuracy (Table 1): Trained only on synthetic prompt pairs, the classifier reaches 99.22 accuracy with 7.18 FPR on CLIP-L/14 and 99.71 accuracy with 11.32 FPR on T5-XXL, detecting nearly 100% of unsafe content on a dataset of over 3000 nudity prompts from adversarial benchmarks.
• Step-size ablation (Table 7): Increasing η from 0.1 to 1.5 steadily lowers ASR (P4D 20.22 to 1.10; RAB 19.65 to 0.00; MMAD 10.70 to 0.10) but affects FID (16.78, 16.61, 16.10, 16.96). η = 1.0 is chosen as the best trade-off for nudity removal.
• Token-importance ablation (Table 8): Removing the token-importance weighting raises ASR on all six benchmarks (e.g., UDA 40.14 vs. 27.46) and worsens FID (16.67 vs. 16.10), confirming the weighted gradient is critical.
• Threshold ablation (Table 9): Varying the detection threshold τ over {0.25, 0.50, 0.75} produces nearly identical results across the six adversarial benchmarks, which the authors attribute to the classifier's high confidence.
• Motivation analysis: The paper reports that standard SAFREE fails on models using the T5 encoder, and that even forcing projection of all tokens (SAFREE⋆) yields only partial erasure. The authors argue SAFREE's reported success on SD-v3 relies on negative prompting, and that it collapses on FLUX, which omits negative prompting.

Methodology in Plain English

CGCE has three stages.

1. Build paired prompts. Large language models (the paper names Gemini and Qwen) generate a dataset where each pair consists of an unsafe prompt containing a target concept and a semantically similar safe prompt without it — for example, "a photo of a nude girl" paired with "a photo of a girl." For each erasure task, the classifier is trained on 1000 such generated prompt pairs. The target concept prompt c is set to "sexual, nudity, sex, porn, naked" for nudity removal, and simply to the concept name (e.g., "Van Gogh" or "church") for other tasks.

2. Train a lightweight classifier. The text encoder (CLIP or T5) converts both the input prompt and the concept prompt into embeddings. A cross-attention layer treats the prompt tokens as queries attending to the concept tokens as keys and values, so each individual prompt token is compared against the concept. The maximum attention weight each prompt token assigns to any concept token becomes an importance score; these are softmax-normalized into a distribution used to weight and pool the attended features into one vector, which passes through an MLP and sigmoid to output a probability that the concept is present. Training uses binary cross-entropy, with safe prompts labeled 0 and unsafe prompts labeled 1, over 10 epochs with the Adam optimizer at a learning rate of 1e-4 and batch size 32.

3. Use the classifier twice at inference. If the classifier's output on a prompt is below the threshold τ = 0.5, the embedding passes to the generator unmodified. If it exceeds τ, the classifier becomes a refiner: it iteratively updates the embedding using the gradient of its own output with respect to the embedding, weighted element-wise by the token importance scores so that only concept-related tokens move much, and normalized by both the gradient norm and the embedding norm for stability. Refinement stops after a fixed number of iterations or once the classifier's output drops below τ. The refined embedding then goes to the T2I or T2V model.

The step size η is task-specific for SD-v1.4: 1.0 for nudity, 0.15 for artistic style, and 0.5 for object removal. Evaluation uses ASR (via NudeNet at a 0.45 threshold for nudity, a style classifier for artistic style, and a ResNet-50 ImageNet classifier for objects), plus FID and CLIP score on 30K generated COCO images. For T2V, ASR is computed frame-by-frame as unsafe frames divided by total frames.

Why This Matters

Impact on research. The paper shifts concept erasure away from weight modification and toward inference-time embedding correction, and it argues that the field's reliance on token-level linear projection is geometrically mismatched to modern text encoders like T5. If the reported robustness holds, it suggests safeguards can be added to already-deployed models as a module rather than by retraining them, and that the same safeguard transfers across both image and video generators.

Real-world applications:

• Safety filtering for hosted image and video generation services, applied as a layer without retraining or redistributing the underlying weights.
• Copyright and intellectual-property protection, e.g., erasing a named artistic style such as Van Gogh.
• Content moderation for user-facing creative tools where unsafe prompts arrive implicitly or through obfuscation rather than as explicit keywords.
• Enterprise deployment of T2V systems, where frame-level safety matters more than single-image filtering.

Industry relevance. Because CGCE reports near-baseline FID and CLIP scores, it targets the key practical objection to safety interventions — that they make the product worse for legitimate users. Its drop-in compatibility with models that omit classifier-free guidance (FLUX) and with VAR architectures addresses a gap where prior inference-time methods simply do not apply.

Future Directions

• Classifier coverage and false positives. With FPR reported at 7.18 (CLIP-L/14) and 11.32 (T5-XXL) on COCO-30K, quantifying how much safe traffic is unnecessarily modified in production remains an open question, and the paper does not report a false-negative rate.
• Scaling beyond a fixed concept list. Each classifier is trained for one target concept on 1000 generated prompt pairs; how well this extends to many concepts, overlapping concepts, or adversarial concepts not seen during synthetic data generation is not established.
• Dependence on synthetic prompt generation. The pipeline inherits whatever biases and blind spots the generator LLMs (Gemini, Qwen) have when constructing unsafe/safe pairs; the paper does not report an analysis of that dependency.
• Video-specific evaluation depth. While frame-level ASR is reported across three T2V models, temporal consistency and the perceptual quality of the refined-video outputs are not evaluated with the same detail as the image results.

Target Audience

Researchers and engineers working on generative model safety, concept unlearning, and red-teaming will find the most value here, particularly those deploying T2I or T2V systems and looking for a safeguard that does not require modifying model weights. It is also relevant to readers interested in text-encoder representation geometry, since the paper's core argument concerns why linear projection fails on T5-style embeddings. Readers without background in diffusion models, classifier-free guidance, or embedding spaces should expect an advanced read.

Authors’ abstract

Recent advancements in large-scale generative models have enabled the creation of high-quality images and videos, but have also raised significant safety concerns regarding the generation of unsafe content. To mitigate this, concept erasure methods have been developed to remove undesirable concepts from pre-trained models. However, existing methods remain vulnerable to adversarial attacks that can regenerate the erased content. Moreover, achieving robust erasure often degrades the model's generative quality for safe, unrelated concepts, creating a difficult trade-off between safety and performance. To address this challenge, we introduce Classifier-Guided Concept Erasure (CGCE), an efficient plug-and-play framework that provides robust concept erasure for diverse generative models without altering their original weights. CGCE uses a lightweight classifier operating on text embeddings to first detect and then refine prompts containing undesired concepts. By modifying only unsafe embeddings at inference time, our method prevents harmful content generation while preserving the model's original quality on benign prompts. Extensive experiments show that CGCE achieves state-of-the-art robustness against a wide range of red-teaming attacks. Our approach also maintains high generative utility, demonstrating a superior balance between safety and performance. We showcase the versatility of CGCE through its successful application to various modern T2I and T2V models, establishing it as a practical and effective solution for safe generative AI.