Exploring and Leveraging Class Vectors for Classifier Editing

AI summary

Overview

• Research area: Computer Vision — specifically post hoc editing of image classifiers, with additional experiments extending to language models (BERT-Base).
• Technical level: Advanced. The paper assumes familiarity with latent representations, fine-tuning, task vectors, weight-space versus latent-space manipulation, and Neural Collapse.
• One-sentence scope: The paper introduces "Class Vectors" — the difference between per-class centroid representations of a fine-tuned and a pretrained encoder — and shows that simple arithmetic on these vectors can edit classifier behavior for unlearning, environment adaptation, typographic-attack defense, and adversarial trigger optimization.

What This Paper Is About

Deeply trained classifiers are rigid: once trained, changing what they know about a specific class usually requires expensive retraining, and existing editing methods either only fix individual misclassified images or demand heavy computation and auxiliary information such as object masks. The authors ask whether the per-class change that happens during fine-tuning can be isolated into a single latent vector, and whether that vector can then be reused to steer or permanently rewrite a classifier's decision rules for that class alone. Their goal is flexible, cheap, class-level editing that leaves other classes untouched.

Key Contributions

1. A new editing primitive: Class Vectors. The authors define a Class Vector κ_c as the difference between the expected last-layer (penultimate) representation of a fine-tuned encoder and that of the pretrained encoder, computed over the samples of class c. This isolates class-level adaptation in latent space, whereas task vectors capture task-level change in weight space.

2. Theoretical grounding for why Class Vectors work. Three results are proved: Theorem 3.1 shows that Cross-Task Linearity deviation is strictly smaller on the segment from pretrained weights to a fine-tuned checkpoint than between two fine-tuned solutions (given ‖θ_i − θ_pre‖ < ‖θ_i − θ_j‖); Theorem 3.2 shows infinitely many valid mappings exist from latent Class Vectors into weight space for an overparameterized encoder with d_e ≫ m when edits are confined to a small subset of layers; Theorem 3.3 uses Neural Collapse to show that a Class Vector is approximately orthogonal (cosine ≈ 0) to the fine-tuned embedding of every other class.

3. Two injection modes and their algorithms. Latent-space injection (Algorithm 1) shifts a representation by z_edit, gated by a cosine-similarity threshold γ to localize the edit, and requires no additional training. Weight-space mapping, denoted Class Vector † (Algorithm 2), trains a small editable block of the encoder so that original embeddings map onto fixed targets formed by adding the Class Vector to reference embeddings.

4. Validation across four editing applications and multiple architectures. Unlearning, adaptation to snowy environments, defense against typographic attacks, and backdoor trigger optimization, evaluated on CLIP ViT-B/16, ViT-B/32 and ViT-L/14 encoders, plus ResNet18, ResNet50, ConvNeXT-Tiny, and BERT-Base.

Main Findings

• Linearity holds along the pretrain-to-fine-tune path. On ViT-B/32 across six downstream tasks, class-c accuracy (normalized by the fully fine-tuned score) rises smoothly and concavely as the interpolation coefficient α goes from 0 to 1. Similar behavior is reported for an MLP and ResNet-18 on CIFAR10 and CIFAR100, and for interpolation between two fine-tuned classes, where predictions switch cleanly from c_1 to c_2 at the midpoint with no detours to other classes.

• Edits are independent across classes. Using MNIST (Figure 3), scaling the target class, adding non-target Class Vectors, retargeting to each destination class, and shifting all classes simultaneously all preserve non-target accuracy. The proposed explanation is Neural Collapse: class-specific feature shifts during fine-tuning become quasi-orthogonal.

• Class unlearning works best with Class Vectors among the compared methods. With λ = −1.5 on ViT-B/16 and the first five labels of each task as the forget class, Class Vector reaches 0.0 ± 0.0 forget-class accuracy (ACC_f) and 99.7 ± 0.0 retained accuracy (ACC_r) on MNIST, and 0.0/99.5 ± 0.2 on EuroSAT, 0.0/98.6 ± 0.0 on GTSRB, 28.2 ± 26.1/94.6 ± 7.2 on RESISC45, and 13.5 ± 16.5/78.1 ± 0.8 on DTD. Class Vector † reaches 0.0/96.2 ± 0.1, 0.0/99.7 ± 0.0, 0.0/93.4 ± 0.0, 10.0 ± 10.9/90.7 ± 3.2, and 15.2 ± 18.7/72.9 ± 0.1 respectively. Retrained and NegGrad lose substantially more non-target accuracy (for example, NegGrad on MNIST: 0.0 ACC_f but 43.4 ± 10.3 ACC_r), and Random Vector has almost no effect (99.9 ± 0.1/99.8 ± 0.0 on MNIST), indicating that Class Vectors point to semantically meaningful directions.

• Adaptation to a snowy environment. On Snowy ImageNet (7 classes, 20 images each), using z_edit = λ(κ_{snow+c_1} − κ_{c_1}) with λ = −1.0 and 4 external samples, Class Vectors deliver a 10–20% improvement over the pre-edit classifier. Class Vector † averages 72.7 ± 21.4 (ViT-B/16), 76.2 ± 21.2 (ViT-B/32), 78.3 ± 16.9 (ViT-L/14), versus DirMatch at 72.0, 73.9, 74.6 and Pretrained at 55.2, 53.4, 60.2.

• Defense against typographic attacks. With z_edit = λ(κ_{text+object} − κ_{object}), λ = −1.5, and 6 ImageNet classes augmented to 15 images per class (4 reference images for mapping), Class Vector † reaches 98.9 ± 2.5 (ViT-B/16), 99.0 ± 2.5 (ViT-B/32), and 93.3 ± 6.7 (ViT-L/14), matching or exceeding clean-image performance, while attacked Pretrained models score 48.9 ± 38.2, 76.7 ± 33.1, and 38.9 ± 19.4.

• Backdoor trigger optimization without weight access. Optimizing trigger pixels to match z_edit = λ(κ_{c_2} − κ_{c_1}) (λ = 1.5 for small patches using 0.8% of total pixels, 1.0 for invisible noise, ViT-B/32), Class Vector † achieves 99.8 ± 2.8 ASR and 95.2 ± 7.1 CA for small patches and 99.0 ± 1.4 ASR with 95.2 ± 7.1 CA for invisible triggers. BadNet reaches 100 ASR but collapses clean accuracy to 10.0 ± 5.0 and 9.3 ± 7.4. Latent steering cannot be used in this scenario because the trigger itself is being optimized.

• Cross-architecture generality. On MNIST unlearning (Table 4), Class Vector † achieves 0.0 ACC_f / 99.4 ACC_r on ResNet18, 0.0 / 99.1 on ResNet50, and 0.0 / 99.1 on ConvNeXT-Tiny. On BERT-Base (Table 5) across AG-NEWS, DBPedia-14, and 20-Newsgroups, Class Vector † reaches 3.2 / 94.4, 0.0 / 99.1, and 0.0 / 63.8.

• Efficiency claim. The authors state edits can be performed without retraining via latent steering, or for specific tasks trained in under 1.5 seconds using fewer than 1.5K parameters and a single sample.

• Task Vector is not a main baseline. The authors explain that task vectors operate at the task-wide level and are unsuitable for class-wise evaluation, but report a comparison in the unlearning setting in their Table 17 (that table's contents are not included in the provided text).

Methodology in Plain English

The procedure starts from two checkpoints of the same architecture: a pretrained model and a model fine-tuned on a task. For each class, the authors pass that class's images through both encoders, average the resulting penultimate-layer features to get a pretrained centroid and a fine-tuned centroid, and subtract one from the other. That difference is the Class Vector.

To edit a classifier, the authors build an editing vector z_edit out of Class Vectors. If they want to forget a class, they subtract a scaled Class Vector. If they want to move one class toward another, they use κ_destination minus κ_target. If they want to remove the effect of snow or of text printed on an object, they subtract the Class Vector of the clean object from the Class Vector of the contaminated (snowy or text-bearing) object and suppress that difference with a negative scaling coefficient λ.

The editing vector can then be applied in one of two ways. The lightweight way adds it directly to the model's latent representation at inference, using a cosine-similarity gate against the target class centroid so that only images resembling that class are affected. The heavier but permanent way trains a small set of encoder layers to reproduce the shifted representations, effectively writing the edit into the weights. For backdoor research, the same vector is instead used as a target for optimizing the pixels of a trigger patch.

Validation is done by checking whether accuracy changes smoothly along interpolation paths (linearity), whether non-target classes keep their accuracy when one class is edited (independence), and whether the method beats retraining, gradient-ascent unlearning, random vectors of matched magnitude, and the task-specific DirMatch baseline.

Why This Matters

• Impact on research. The work reframes classifier editing as an operation on class-level latent geometry rather than an image-by-image correction problem or a full retraining problem. It links three previously separate ideas — task vectors, Cross-Task Linearity, and Neural Collapse — into a single editing recipe, and it extends editing experiments beyond vision to BERT-Base.

• Real-world applications:

  • Medical imaging, where a user may need to suppress a specific diagnosis category or make the model robust to a particular acquisition artifact, as the paper's introduction motivates with disease diagnosis.
  • Manufacturing anomaly detection, which the abstract names as a domain where class-level forgetting or adaptation matters.
  • Autonomous or outdoor perception, illustrated by the snowy-environment scenario where a model mislabels buses in snow as snowplows because it learned the shortcut "vehicle + snow → snowplow."
  • Safety-critical deployment against typographic attacks, where text inside an image (for example a label reading "iPod") causes misclassification, and against backdoor triggers, which the authors study from the attacker's perspective to show that high attack success rates are achievable without access to the victim's weights.

• Industry relevance. Open model hubs such as HuggingFace distribute many fully fine-tuned classifiers, and the paper argues that a one-size-fits-all model cannot satisfy every user's distributional context or risk tolerance. A method that modifies a downloaded classifier in under 1.5 seconds with fewer than 1.5K parameters and a single sample lowers the cost of per-customer customization, and the permanence offered by weight-space mapping means the edit does not require extra runtime computation.

Future Directions

• The paper's provided text is truncated mid-way through Section 4.6 ("In-Depth Analysis"), so the full set of additional analyses, ablations, and appendix results (Sections C.1–C.3, D.3, D.3.2, E; Figures 8 and 10; Tables 7 and 17) is not available here and their details are not reported in the content above.
• Extending Class Vectors beyond classification, since the current formulation depends on class-conditional centroids in a penultimate layer; the paper does not report results for dense prediction, detection, or generative tasks.
• Determining the limits of the independence guarantee. Theorem 3.3 relies on assumptions including collapsed pretrained embeddings, a center-shifted ETF form after fine-tuning, and negligible global drift, leaving open how the method degrades when those assumptions are violated.
• The backdoor results raise an open question about defenses: the paper demonstrates high attack success with optimized triggers against unmodified weights, and the provided text does not report an evaluation of detection or mitigation methods for this attack path.

Target Audience

Researchers and engineers working on model editing, transfer learning, and representation geometry, particularly those familiar with task vectors, Neural Collapse, and CLIP-style vision encoders. It is also relevant to practitioners who deploy third-party fine-tuned classifiers and need cheap, targeted customization, and to security researchers studying backdoor attacks and typographic vulnerabilities. Readers without a background in latent-space methods or linear mode connectivity will find the theoretical sections demanding.

Authors’ abstract

Image classifiers play a critical role in detecting diseases in medical imaging and identifying anomalies in manufacturing processes. However, their predefined behaviors after extensive training make post hoc model editing difficult, especially when it comes to forgetting specific classes or adapting to distribution shifts. Existing classifier editing methods either focus narrowly on correcting errors or incur extensive retraining costs, creating a bottleneck for flexible editing. Moreover, such editing has seen limited investigation in image classification. To overcome these challenges, we introduce Class Vectors, which capture class-specific representation adjustments during fine-tuning. Whereas task vectors encode task-level changes in weight space, Class Vectors disentangle each class's adaptation in the latent space. We show that Class Vectors capture each class's semantic shift and that classifier editing can be achieved either by steering latent features along these vectors or by mapping them into weight space to update the decision boundaries. We also demonstrate that the inherent linearity and orthogonality of Class Vectors support efficient, flexible, and high-level concept editing via simple class arithmetic. Finally, we validate their utility in applications such as unlearning, environmental adaptation, adversarial defense, and adversarial trigger optimization.