EMMA: Concept Erasure Benchmark with Comprehensive Semantic Metrics and Diverse Categories

AI summary

Overview

Research area: Computer vision, specifically text-to-image (T2I) generative models and machine unlearning (known in this subfield as "concept erasure").

Technical level: Advanced. The paper assumes familiarity with diffusion models, unlearning methods, concept classifiers, and metrics such as FID, SSIM, and CLIP similarity.

Scope: The paper introduces EMMA, a benchmark that evaluates concept erasure methods across five concept domains, five evaluation dimensions, and 13 metrics, and uses it to test five state-of-the-art erasure methods.

What This Paper Is About

Text-to-image models can be made to "forget" unwanted concepts (objects, celebrities, art styles, NSFW content, copyrighted logos) without retraining, but the authors argue that existing evaluations only check whether the concept's name stops working. The paper asks whether erasure actually removes a concept from the model's internal representation, or merely hides it at the surface level of specific words. To answer this, the authors build EMMA, a benchmark with more challenging prompts and broader metrics, and use it to test five concept erasure methods.

Key Contributions

1. A benchmark spanning five domains and 206 concept categories. EMMA covers objects (79 categories from COCO, excluding the person class), celebrities (50, curated from the 2,300 listed in the GIPHY Celebrity Detector after randomly sampling 300 candidates and filtering), art styles (40, selected from the 129 style categories in UnlearnCanvas), NSFW (7 fine-grained classes from the I2P dataset), and copyright (30 branded logos drawn from LogoDet-3K).

2. Five evaluation dimensions quantified by 13 metrics. These are erasing ability (EA), retaining ability (RA), efficiency, image quality, and bias.

3. New evaluation angles that prior tools lacked. EA is extended beyond explicit concept names to implicit prompts (variants, short descriptions, long descriptions), RA is extended from random non-target concepts to visually similar non-target concepts, efficiency adds a hardware-agnostic compute budget alongside unlearning and inference time, and bias is measured for both gender and ethnicity.

4. An empirical audit of five erasure methods. CA, ESD, UCE, MACE, and FMN are evaluated on EMMA, revealing resurgent concepts under implicit prompts, collateral damage to similar concepts, higher computational cost, and bias amplification.

Main Findings

• Concept remapping beats optimization. ESD, UCE, and MACE (which remap a target concept to an unrelated alternative by modifying cross-attention weights) outperform CA and FMN (optimization-based fine-tuning) by a large margin in both EA and RA. FMN does not effectively erase concepts in the object domain, performing on par with the unmodified Stable Diffusion model, and its RA is consistently worse than SD, indicating collateral damage to unrelated concepts.

• Implicit prompts break erasure. MACE's EA in the object domain drops from 98.6 on the name metric to 70.5 on long descriptions. This pattern does not hold for celebrities, where even the original SD fails to generate the correct person from descriptions alone, producing high EA scores by default. NSFW is the most challenging domain, with the lowest EA scores.

• Similar concepts are harder to retain. CA, ESD, UCE, and MACE all show lower RA on similar than on random non-target concepts, while the original SD shows no such gap (except in NSFW, where non-target concepts come from a different domain). The object domain shows the largest gap, with MACE's RA dropping from 91.6 to 79.4; the copyright domain shows a much smaller decline from 36.9 to 34.7.

• Quality holds, cost rises. Most methods preserve image quality, achieving comparable or better FID than the original SD. Inference time increases by 2x to 10x according to the results section (the abstract summarizes this as 2 to 8 times), and the abstract reports unlearning requires 30 to 3000 seconds per concept. Table 3 lists training times ranging from 30.4 seconds (UCE on NSFW) to 4005.2 seconds (CA on NSFW). UCE and MACE are fastest to train; ESD is generally most efficient at inference.

• Bias is amplified more often than mitigated. FMN is the only method to consistently reduce bias, which the authors partly attribute to its highly biased base model (SD 2.1) offering more room for improvement. ESD consistently amplifies both gender and ethnic bias. CA, UCE, and MACE show mixed, non-directional results.

• No method fully erases a concept. The authors conclude that "erased" concepts often resurface under implicit descriptions.

Methodology in Plain English

EMMA has two halves. The first half defines what to erase: fixed lists of concepts across five domains, drawn from established datasets and filtered for reliability (for example, celebrity candidates that Stable Diffusion could not reliably generate were removed before manual curation).

The second half defines how to test. For each concept and each metric, the researchers build prompt sets using domain-specific templates such as "an image of <c>", "a photo of <c>", "a photo in the style of <c>", "a <c> photo", and "an image with <c> logo". The placeholder is swapped per metric: the concept name for name, a compound word for prefix, a synonym for variant, a random same-domain concept for random, and a similar concept for similar. Variants, short descriptions, long descriptions, and similar concepts are generated with ChatGPT; ten variants, five short sentences, and five long descriptions are produced per concept, and prefix prompts use five prefix types (noun, adjective, emotion, verb-ing, preposition) with two prefixes chosen per type, giving 10 prompts per target concept. The variant metric is skipped for celebrities and art styles because proper nouns lack synonyms. Long descriptions are produced by asking ChatGPT to expand the short ones.

Thirty images are generated per prompt for each domain. Domain-specific classifiers then judge whether the target (for EA) or non-target (for RA) concept appears: ML-Decoder for objects, GCD for celebrities, UnlearnDiffAtk for art styles, NudeNet, Q16, and ML-Decoder for NSFW, and YOLOv11 fine-tuned on 30 LogoDet-3K classes for copyright. EA and RA scores are computed as ratios of successfully erased or retained images to the number of prompts. Image quality uses FID against the 40,504 COCO validation images. Efficiency measures unlearning time, inference time, and hardware-agnostic budget items such as total and trained parameters, inference TMACs, training iterations, and training cost, computed on an NVIDIA RTX 6000 Ada Generation GPU. Bias compares images from neutral prompts against attribute-specific prompts using SSIM and CLIP similarity, with male as the gender reference and White as the ethnicity reference; a positive score indicates bias toward the reference group. The paper reports that the indirect prompts were validated by a human evaluation, with overall accuracy of 0.91 for short descriptions and 0.93 for long descriptions; the details of that evaluation are placed in the supplementary material and are not reported in the content provided here.

Why This Matters

The paper argues that existing evaluation protocols are fragmented across method papers and benchmark papers, covering at most a few domains and often only 7 to 20 concepts, and that they measure surface-level token removal rather than genuine semantic erasure. The biases evaluated are also a side effect that is commonly overlooked: unlearning can shift a model's demographic balance.

Real-world applications:

• Content moderation and removal of context-specific elements from generated images.
• Privacy protection for public figures' likenesses, and reduction of legal and ethical risk from unauthorized use.
• Compliance with copyright law when generating images involving branded logos or named artistic styles.
• Safe deployment of generative models by filtering inappropriate or toxic content such as sexual, self-harm, and hate categories.

Industry relevance: Any organization deploying a T2I model that must meet content policies, intellectual property rules, or fairness commitments needs to know whether a claimed erasure actually holds under realistic user prompts. EMMA's inclusion of an explicit compute budget (parameters, TMACs, iterations, training cost, inference time) speaks directly to deployment cost, and its bias metrics address reputational and regulatory exposure.

Future Directions

1. Erase representations in latent space rather than specific tokens, to close the gap between token-level erasure and semantic-level erasure.
2. Regularize erasure to preserve the generation of visually similar concepts, addressing the consistent RA drop observed on similar non-target concepts.
3. Monitor demographic balance during unlearning to prevent bias amplification relative to the original model.
4. An implicit open question: how to handle domains like NSFW and celebrating, where the low baseline performance of the original model makes high EA scores hard to interpret as evidence of genuine erasure.

Target Audience

Researchers and practitioners working on diffusion-model safety, machine unlearning, and concept erasure, including those who design erasure algorithms and those who need to compare them fairly. It is also useful for teams deploying T2I systems who must justify content filtering, copyright compliance, and fairness claims, and for benchmark designers interested in how to construct semantic, multi-dimensional evaluation suites. The code and prompts are released at https://github.com/lobsterlulu/EMMA.

Authors’ abstract

The widespread adoption of text-to-image (T2I) generation has raised concerns about privacy, bias, and copyright violations. Concept erasure techniques offer a promising solution by selectively removing undesired concepts from pre-trained models without requiring full retraining. However, these methods are often evaluated on a limited set of concepts, relying on overly simplistic and direct prompts. To test the boundaries of concept erasure techniques, and assess whether they truly remove targeted concepts from model representations, we introduce EMMA, a benchmark that evaluates five key dimensions of concept erasure over 13 metrics. EMMA goes beyond standard metrics like image quality and time efficiency, testing robustness under challenging conditions, including indirect descriptions, visually similar non-target concepts, and potential gender and ethnicity bias, providing a socially aware analysis of method behavior. Using EMMA, we analyze five concept erasure methods across five domains (objects, celebrities, art styles, NSFW, and copyright). Our results show that existing methods struggle with implicit prompts (i.e., generating the erased concept when it is indirectly referenced) and visually similar non-target concepts (i.e., failing to generate non-target concepts resembling the erased one), while some amplify gender and ethnicity bias compared to the original model. Code and prompts are available at https://github.com/lobsterlulu/EMMA.