Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

Do Concept Replacement Techniques Really Erase Unacceptable Concepts?

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read State-of-the-art concept-replacement techniques fail to erase unacceptable concepts: images containing them are reconstructed intact through empty-prompt image-to-image inversion, so the erasure does not transfer to image-editing services.

desk verdict The reconstruction experiment is real and new, but the 'fail to erase' claim overreaches because the empty-prompt test strips out the text conditioning these CRTs actually modify. read the letter →

arxiv 2506.08991 v1 pith:KNYO2TDP submitted 2025-06-10 cs.CV cs.CR

Anudeep Das , Gurjot Singh , Prach Chantasantitam , N. Asokan This is my paper · ORCID
classification cs.CVcs.CR
keywords concepterasurereplacementtechniquesdiffusionmodelstext-to-imagegenerationimage-to-imageeditingDDPMinversioncelebritylikenesssafe
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that concept replacement techniques (CRTs), weight-editing methods that claim to erase unacceptable concepts such as nudity, copyrighted characters, or celebrity likenesses from diffusion models, do not truly erase those concepts. The authors test this by feeding an image that already contains an unacceptable concept through the CRT-aligned model using DDPM inversion with an empty text prompt; if the model reconstructs the concept, erasure has failed. Across three state-of-the-art CRTs (Moderator, UCE, MACE) and an unaligned baseline, the unacceptable concepts come back, with reconstruction quality statistically equal to or better than the unaligned model. The paper then argues that a good CRT must also preserve fidelity, keeping acceptable parts of the image intact while replacing the unacceptable part, and proposes AntiMirror, a targeted editing pipeline that changes only facial features to replace celebrity likenesses while preserving the rest. If correct, the central claim matters because image-editing services accept images as input, a setting where text-dependent erasure does not engage.

What carries the argument

The load-bearing mechanism is the empty-prompt DDPM-inversion reconstruction test: the input image is encoded to a latent, inverted back to initial noise using DDPM inversion, and then reconstructed with a CRT-aligned UNet conditioned on the empty prompt, making the text channel carry no information about the unacceptable concept. This isolates whether the concept survives in the model's weights and latents rather than in the prompt, which is exactly the paper's operational definition of "truly erased." The other central object is AntiMirror, a post-processing pipeline that extracts the detected face, checks it with an unacceptable-concept detector, morphs a facial-feature mask (eyes, nose, chin, lips) via dilation and geometric transforms, and Poisson-blends the edited face back into the unchanged background; it is a targeted-editing CRT rather than a weight-editing CRT, so it replaces only identity-bearing features and thereby preserves fidelity.

What would settle it

Take a CRT-aligned model that scores zero on text-prompted celebrity generation, feed a celebrity image through empty-prompt DDPM inversion, and measure identity persistence with a face-recognition embedding such as FaceNet cosine distance together with human ratings instead of CLIP. If the reconstructed face is not matched to the original celebrity, the paper's claim that the concept reappears is refuted; if the identity does match while text-prompt generation of the same celebrity is blocked, the erasure failure is confirmed and shown to be independent of the text channel.

Watch

Extended reading notes

Core claim

The paper's central claim is that a concept is erased from a diffusion model only if the model cannot produce content depicting that concept under any circumstance, including image-conditioned reconstruction. Since the UNet is the shared backbone of text-to-image and image-to-image generation, a weight-editing CRT that removes the concept from the weights should block reconstruction of an unacceptable input image just as it blocks text-prompted generation. The authors show this is not what happens: when unacceptable images are inverted with DDPM inversion and reconstructed with an empty prompt through models aligned by Moderator, MACE, or UCE, the unacceptable concepts persist, with CLIP similarity to the concept staying near or above the 0.25 correlation threshold, reconstruction error and perceptual distance equal to or better than the unaligned model, and a celebrity detector still recognizing the faces. They conclude that these CRTs are effective only against text-prompt conditioning and are therefore unreliable for emerging image-to-image editing services, and they demonstrate AntiMirror, a post-processing pipeline that detects the celebrity face, edits facial-feature masks, and blends the edited face back into the preserved background, as a fidelity-preserving alternative.

Load-bearing premise

The load-bearing premise is that "erased" must mean the concept cannot reappear even when an unacceptable input image is reconstructed with an empty prompt; if erasure is instead judged by the text-prompt generation setting these CRTs were designed for, the reconstruction test is an out-of-scope use and the negative result does not show the CRT failed at its intended task.

Editorial extensions

If this is right

  • Weight-editing CRTs currently deployed for text-to-image safety should not be assumed to protect image-editing services, since the unacceptable concept can be recovered from the image channel alone.
  • Model providers offering image-editing services need a safety layer that operates on outputs, such as detection-plus-editing or filtering, rather than relying on weight erasure alone.
  • Erasure claims should be evaluated under image-conditioned reconstruction in addition to text-prompt generation, if the definition of erasure is that the concept never appears.
  • AntiMirror-type targeted editing can replace an identity while preserving background and other acceptable content, which prompt-based editing such as SDEdit does not reliably do.
  • A concept detector combined with localized face editing offers a trade-off between effectiveness and fidelity that weight-editing CRTs cannot reach for celebrity likenesses.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's test defines erasure as absolute, so the reconstruction experiment measures a stronger property than the CRTs claim; an implicit extension is that the same empty-prompt inversion probe could serve as a standard evaluation harness for future erasure methods, and as an adversarial recovery route for users trying to regenerate blocked content.
  • Because the authors note that a second inversion method, LEDITS++, behaves like DDPM inversion, the failure likely is a general property of image-conditioned generation with these UNets rather than an artifact of one inversion algorithm.
  • The fidelity notion suggests a practical service design: instead of refusing or regenerating a flagged image, an editing service could detect the unacceptable region and surgically patch it; the paper demonstrates this only for faces, but the detect-region, edit-localized-mask, blend pattern is transferable wherever a reliable pixel-level detector exists.
  • A testable extension would be combining weight-editing CRTs with a post-hoc detector such as Espresso; if detection plus targeted editing closes the reconstruction gap, the paper's negative result becomes an argument for defense-in-depth rather than for abandoning weight editing.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper investigates whether concept replacement techniques (CRTs) that modify diffusion model weights—MOD, MACE, and UCE—actually erase unacceptable concepts, focusing on the emerging image-to-image (I2I) setting. Using DDPM inversion with an empty text prompt, the authors reconstruct images containing unacceptable concepts (offensive, copyrighted, celebrity-likeness) through CRT-aligned Stable Diffusion v1.5 models and find that the reconstructed images still contain the unacceptable concepts, leading them to conclude that these CRTs "fail to erase" the concepts. The paper then introduces a fidelity criterion, arguing that a good CRT should preserve acceptable content while replacing unacceptable content, and proposes AntiMirror, a targeted face-editing post-processing technique that replaces celebrity identities while preserving background and other facial attributes. Experiments compare AntiMirror with SDEdit and with the weight-editing CRTs, reporting that AntiMirror achieves a better effectiveness-fidelity trade-off for celebrity likenesses.

Significance. The paper addresses a timely and important question: whether weight-editing concept erasure methods remain effective when the same diffusion backbone is used in image-conditioned generation, which is increasingly common in deployed editing services. Strengths include the use of public CRT implementations, repeated trials with reported standard deviations, and the use of an external celebrity detector (GCD) to validate effectiveness, which avoids circularity for the main negative result. The identification of fidelity as a neglected dimension of CRT evaluation and the proposal of a targeted-editing alternative are useful contributions. However, the central negative claim is currently stated more strongly than the evidence supports: the empty-prompt reconstruction test does not exercise the text-conditioning mechanism that these CRTs are designed to modify, and the paper's own discussion concedes this point. If re-scoped or supplemented with text-conditioned tests, the finding would be of clear value to the community; as written, the headline claim overreaches.

major comments (3)
  1. [Sec. 2.5 and Sec. 3.5] The absolute definition of erasure in Sec. 2.5 ("under no circumstance") is asserted rather than argued, and it conflicts with the CRTs' own objectives as formulated in Sec. 2.4. UCE and MACE edit cross-attention layers that fuse text embeddings with latents, and MOD overfits on unacceptable images together with their text prompts; all three mechanisms require a text conditioning signal to suppress. In the experiment, the prompt is empty (c=∅), so there is no unacceptable text embedding for the CRT to act on. The paper's own Sec. 3.5 states that "there is no useful textual information that the CRT could use, thus causing them to fail." This concession directly undermines the Sec. 9 conclusion that "CRTs that claim to erase unacceptable concepts fail to do so": the experiment demonstrates failure to prevent image-conditioned copying with an empty prompt, not failure to erase the concept under the conditions the CRTs were designed for. The central claim should be re-scoped, or an additional experiment should be run with the original text prompt (e.g., "An image of {celebrity}") included in the reconstruction to test whether the CRT changes the output when its conditioning mechanism is active.
  2. [Sec. 3.3 and Table 2] The CLIP-score threshold of 0.25 is used to declare that an unacceptable concept is present, but the baseline NONE scores hover at or near this threshold for many concepts (e.g., Angelina Jolie 0.25±0.02, Donald Trump 0.24±0.01, Nudity 0.24±0.01), and the CRT-aligned scores are statistically indistinguishable from NONE in most rows. This makes the threshold incapable of discriminating between a model that has erased the concept and one that has not, which weakens the claim that CRTs have "negligible or even detrimental" effect. The paper should either justify the threshold in this reconstruction setting, report score distributions rather than binary decisions, or use a more discriminative detector (as it later does with GCD for celebrities) for all concept categories.
  3. [Sec. 3.1 and Sec. 3.2] The evaluation images are generated by SDXL, while the tested backbone is SD v1.5, as required by the public CRT implementations. This creates a distribution mismatch: SD v1.5 may reconstruct SDXL-generated images differently than it would reconstruct its own outputs, independent of any CRT effect. The paper does not address this confound. A control experiment using images generated by SD v1.5 itself (or at least a discussion of the potential impact on reconstruction quality) would make the negative result more robust.
minor comments (5)
  1. [Abstract and Sec. 9] The statements "CRTs do not in fact erase unacceptable concepts" (Abstract) and "CRTs that claim to erase unacceptable concepts fail to do so" (Sec. 9) should be tempered to reflect the empty-prompt, image-reconstruction setting, e.g., "do not prevent unacceptable concepts from being reconstructed when no text prompt is supplied." As written, the conclusions are broader than the experiments.
  2. [Table 2] In the R2D2 row, the MACE reconstruction error is reported as 38.05±10.44, with a standard deviation far larger than every other entry in the table; this may be a typo or an unstable outlier run and should be checked.
  3. [Sec. 6.1] The paper argues that CLIP score is not a fair effectiveness metric for targeted edits because it responds to global image-text correspondence, yet Sec. 3 uses the same CLIP threshold to conclude that weight-editing CRTs are ineffective. This inconsistency should be acknowledged explicitly, since the later GCD-based validation only covers celebrity concepts, not offensive or copyrighted ones.
  4. [Sec. 5] The AntiMirror mask-editing parameters (dilation sizes, geometric transformation coefficients, and the CelebHQ-based mask editing configuration) are not specified, which prevents replication of the proposed technique; the authors state they will release code, but the manuscript should include at least the key parameter values.
  5. [Appendix, Table 11 caption] The caption contains a typo: "he metrics from reconstruction" should read "the metrics from reconstruction."

Circularity Check

1 steps flagged · score 2.0 of 10

No significant circularity: the headline CRT-failure result is benchmarked externally and no step reduces by construction; the sole Espresso self-citation in AntiMirror is non-load-bearing, while the absolute 'under no circumstance' erasure definition and the paper's own Sec. 3.5 concession narrow the claim's scope rather than make it circular.

  1. other [Sec. 5, 'Unacceptable Concept Check' (AntiMirror pipeline)]
    "The extracted facial images then undergo an unacceptable-concept-detection step to ensure that editing only occurs if a celebrity identity is detected. This is implemented using a state-of-the-art detector, Espresso [4]."

    Espresso [4] is the authors' own prior work (Das, Duddu, Zhang, Asokan; two authors overlap with this paper) and gates AntiMirror's editing. It is not load-bearing and so not circular: the paper's central claim (Sec. 9: CRTs fail to erase) never uses Espresso and is benchmarked on unmodified upstream CRT code with external GCD, CLIP (threshold from Brack et al.), and LPIPS; AntiMirror's effectiveness/fidelity are validated externally via GCD (Table 7) and LPIPS (Table 8). The CRT-failure observation is measured, not entailed; no parameter fitted from Espresso is renamed as a prediction. This is the rubric's 'minor self-citation that is not load-bearing' (score 2).

full rationale

The derivation chain is not circular. The paper's central claim — that weight-editing CRTs (MOD, UCE, MACE) do not prevent unacceptable concepts from reappearing under empty-prompt DDPM-inversion reconstruction — is an empirical measurement, not a derived result: the CRTs are taken unchanged from their external GitHub repositories, the images are generated by an unmodified SDXL baseline, and acceptability/reconstruction are scored with external metrics (LPIPS, CLIP with the 0.25 threshold cited from Brack et al., and the Giphy Celebrity Detector). No parameter is fitted and renamed as a prediction, and no equation reduces to its own input by construction; the reconstructions are observed, not entailed by the test setup. The only self-citation is Espresso [4], used as AntiMirror's detection gate; it is not load-bearing because AntiMirror's end-to-end effectiveness and fidelity are validated externally (GCD, Table 7; LPIPS, Table 8) and the Sec. 3 negative result never invokes it. Two scope concerns are flagged per the reviewing rule rather than counted as circularity: (i) the Sec. 2.5 definition that a truly erased concept 'should, under no circumstance, produce content' is asserted, not defended against the text-conditioned objectives of the CRTs described in Sec. 2.4; and (ii) Sec. 3.5 concedes that 'there is no useful textual information that the CRT could use, thus causing them to fail,' meaning the empty-prompt test removes the conditioning that UCE, MACE, and MOD edit, so the result does not show the concepts persist under text-conditioned generation or realistic prompt-driven I2I editing. These concessions narrow the scope of the conclusion — a correctness risk — but the derivation itself is self-contained against external benchmarks.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central negative result depends on a strong definition of erasure (axiom 1) and on a cross-model evaluation dataset (axiom 2). AntiMirror's claims depend on hand-set mask-editing parameters and on accepting GCD as the effectiveness metric; these are not specified or independently validated. No new physical or conceptual entities are introduced.

free parameters (3)
  • AntiMirror mask-editing parameters (dilation sizes, geometric transformation coefficients) = not specified
    Section 5 says masks are edited with morphological operations and geometric transformations but gives no numeric values; these hand-set choices control how much identity is changed and likely affect both effectiveness and fidelity.
  • SDEdit prompt templates ('random man' / 'random woman') = text strings
    Section 6 uses these manually chosen prompts for the SDEdit baseline; effectiveness depends on them.
  • CLIP acceptability threshold 0.25 = 0.25
    Section 3.3 adopts 0.25 from prior work as threshold for semantic equivalence; conclusions about CRT failure depend on this boundary when many scores sit near it (0.23-0.28).
assumptions (4)
  • ad hoc to paper A model that has truly erased a concept must not produce it under any input, including image reconstruction with an empty prompt.
    Sec. 2.5 defines erasure this way; the main negative result relies on this definition, which is stronger than the text-prompt-conditional objective of MOD, MACE, UCE.
  • domain assumption Images generated by SDXL are a valid proxy for unacceptable concepts when testing CRTs on SD v1.5.
    Sec. 3.1 generates the evaluation set with SDXL, while all CRTs use SD v1.5; the paper does not test whether SDXL outputs are representative inputs for SD v1.5 reconstruction.
  • domain assumption Facial features (nose, bone structure, lips, eyes) are the characteristics defining celebrity identity, and editing only them replaces identity while preserving fidelity.
    Sec. 5 cites prior work; AntiMirror's design and fidelity claim rest on this assumption, which is not validated for each celebrity beyond qualitative examples.
  • domain assumption GCD (Giphy Celebrity Detector) is a valid effectiveness metric for AntiMirror's outputs.
    Sec. 6.1 introduces GCD after CLIP scores show no improvement; the paper does not independently validate GCD on AntiMirror's partially edited faces beyond citing MACE.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Do Concept Replacement Techniques Really Erase Unacceptable Concepts?." pith.science (2026). https://pith.science/paper/KNYO2TDP

@misc{pith2026250608991,
  author       = {Pith},
  title        = {Pith review of: Do Concept Replacement Techniques Really Erase Unacceptable Concepts?},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KNYO2TDP}},
  note         = {Machine review of arXiv:2506.08991}
}
read the original abstract

Generative models, particularly diffusion-based text-to-image (T2I) models, have demonstrated astounding success. However, aligning them to avoid generating content with unacceptable concepts (e.g., offensive or copyrighted content, or celebrity likenesses) remains a significant challenge. Concept replacement techniques (CRTs) aim to address this challenge, often by trying to "erase" unacceptable concepts from models. Recently, model providers have started offering image editing services which accept an image and a text prompt as input, to produce an image altered as specified by the prompt. These are known as image-to-image (I2I) models. In this paper, we first use an I2I model to empirically demonstrate that today's state-of-the-art CRTs do not in fact erase unacceptable concepts. Existing CRTs are thus likely to be ineffective in emerging I2I scenarios, despite their proven ability to remove unwanted concepts in T2I pipelines, highlighting the need to understand this discrepancy between T2I and I2I settings. Next, we argue that a good CRT, while replacing unacceptable concepts, should preserve other concepts specified in the inputs to generative models. We call this fidelity. Prior work on CRTs have neglected fidelity in the case of unacceptable concepts. Finally, we propose the use of targeted image-editing techniques to achieve both effectiveness and fidelity. We present such a technique, AntiMirror, and demonstrate its viability.

Figures

Figures reproduced from arXiv: 2506.08991 by the authors.

Figure 1
Figure 1. Diffusion process. Standard Gaussian noise is added as part of forward diffusion process, followed by denoising [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. For many of the results, the LPIPS and Recon values were lower than those from NONE, and the CLIP scores were greater, with at least one of these metrics being beyond the standard deviation from NONE. These concepts and CRTs are Angelina Jolie for all CRTs, Taylor Swift for MOD and MACE, Brad Pitt and Elon Musk for all CRTs, Donald Trump for MOD and MACE, and Joe Biden for all CRTs. This directly contradicts the int… view at source ↗
Figure 2
Figure 2. Diffusion-based image generation pipeline. An input image is encoded into a latent space via a VAE. Standard [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figures from the paper (3 more)
Figure 3
Figure 3. Figure 3: Concept replacement using an image editing technique (SDE [PITH_FULL_IMAGE:figures/full_fig_p007_3.png]
Figure 4
Figure 4. Figure 4: Concept replacement with a targeted editing approach. When a face is detected in the reconstructed image, it [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: Bar plots comparing NONE, SDEDIT, and ANTIMIRROR using LPIPS and GCD. A smaller value in the LPIPS plot (left) indicates higher fidelity and a smaller value in the GCD plot (right) indicates higher effectiveness. Our method achieves a better trade-off, balancing identi…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. ReVision : A Post-Hoc, Vision-Based Technique for Replacing Unacceptable Concepts in Image Generation Pipeline

    cs.CR 2026-02 conditional novelty 4.0 of 10

    ReVision uses a vision-language model's bounding box to gate attention-based image editing, suppressing unsafe concepts while better preserving benign background in multi-concept scenes.

Reference graph

Works this paper leans on

46 extracted references · 39 canonical work pages · cited by 1 Pith paper

  1. [1]

    Morariu, Soheil Feizi, and Varun Manjunatha

    Samyadeep Basu, Nanxuan Zhao, Vlad I. Morariu, Soheil Feizi, and Varun Manjunatha. Localizing and editing knowledge in text-to- image generative models. InThe Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7- 11, 2024. OpenReview.net, 2024

    work page 2024

  2. [2]

    States Target AI Deepfakes in Taylor Swift After- math (Correct)

    Bloomberg Law. States Target AI Deepfakes in Taylor Swift After- math (Correct). https://news.bloomberglaw.com/artificial-intellige nce/state-lawmakers-target-ai-deepfakes-in-taylor-swift-aftermath,

    work page

  3. [3]

    LED- ITS++: limitless image editing using text-to-image models

    Manuel Brack, Felix Friedrich, Katharina Kornmeier, Linoy Tsaban, Patrick Schramowski, Kristian Kersting, and Apolinário Passos. LED- ITS++: limitless image editing using text-to-image models. InCVPR, pages 8861–8870. IEEE, 2024

    work page 2024

  4. [4]

    Espresso: Robust concept filtering in text-to-image models

    Anudeep Das, Vasisht Duddu, Rui Zhang, and N Asokan. Espresso: Robust concept filtering in text-to-image models. InCODASPY ’25: Proceedings of the Fourteenth ACM Conference on Data and Application Security and Privacy (to appear), 2024

    work page 2024

  5. [5]

    Diego-Mas, Felix Fuentes-Hurtado, Valery Naranjo, and Mar- iano Alcañiz

    Jose A. Diego-Mas, Felix Fuentes-Hurtado, Valery Naranjo, and Mar- iano Alcañiz. The influence of each facial feature on how we perceive and interpret human faces.i-Perception, 11(5):2041669520961123,

    work page

  6. [6]

    Unified concept editing in diffusion models

    Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzyn- ska, and David Bau. Unified concept editing in diffusion models. In WACV, pages 5099–5108. IEEE, 2024

    work page 2024

  7. [7]

    Selective amnesia: A continual learning approach to forgetting in deep generative models

    Alvin Heng and Harold Soh. Selective amnesia: A continual learning approach to forgetting in deep generative models. InNeurIPS, 2023

    work page 2023

  8. [8]

    Denoising diffusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In Hugo Larochelle, Marc’Aurelio Ranzato, Raia Hadsell, Maria-Florina Balcan, and Hsuan-Tien Lin, editors, Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual, 2020

    2020

Show all 46 references
  1. [9]

    Denoising diffusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. InNeurIPS, 2020

    2020

  2. [10]

    An edit friendly DDPM noise space: Inversion and manipulations

    Inbar Huberman-Spiegelglas, Vladimir Kulikov, and Tomer Michaeli. An edit friendly DDPM noise space: Inversion and manipulations. In CVPR, pages 12469–12478. IEEE, 2024

    2024

  3. [11]

    Editing models with task arithmetic

    Gabriel Ilharco, Marco Túlio Ribeiro, Mitchell Wortsman, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi. Editing models with task arithmetic. InICLR. OpenReview.net, 2023

    2023

  4. [12]

    Ablating concepts in text-to-image diffusion models

    Nupur Kumari, Bingliang Zhang, Sheng-Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Yan Zhu. Ablating concepts in text-to-image diffusion models. InICCV, pages 22634–22645. IEEE, 2023

    2023

  5. [13]

    Maskgan: Towards diverse and interactive facial image manipulation

    Cheng-Han Lee, Ziwei Liu, Lingyun Wu, and Ping Luo. Maskgan: Towards diverse and interactive facial image manipulation. InCVPR, pages 5548–5557. Computer Vision Foundation / IEEE, 2020. 13

    2020

  6. [14]

    Source prompt disentangled inversion for boosting image editability with diffusion models

    Ruibin Li, Ruihuang Li, Song Guo, and Lei Zhang. Source prompt disentangled inversion for boosting image editability with diffusion models. InECCV (26), volume 15084 ofLecture Notes in Computer Science, pages 404–421. Springer, 2024

    2024

  7. [15]

    Get what you want, not what you don’t: Image content suppression for text-to-image diffusion models

    Senmao Li, Joost van de Weijer, Taihang Hu, Fahad Shahbaz Khan, Qibin Hou, Yaxing Wang, and Jian Yang. Get what you want, not what you don’t: Image content suppression for text-to-image diffusion models. InICLR. OpenReview.net, 2024

    2024

  8. [16]

    ADBM: adversarial diffusion bridge model for reliable adversarial purification

    Xiao Li, Wenxuan Sun, Huanran Chen, Qiongxiu Li, Yingzhe He, Jie Shi, and Xiaolin Hu. ADBM: adversarial diffusion bridge model for reliable adversarial purification. InThe Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, April 24-28, 2025....

    2025

  9. [17]

    Safegen: Mitigating sexually explicit content generation in text-to-image models

    Xinfeng Li, Yuchen Yang, Jiangyi Deng, Chen Yan, Yanjiao Chen, Xiaoyu Ji, and Wenyuan Xu. Safegen: Mitigating sexually explicit content generation in text-to-image models. InCCS, pages 4807–

  10. [18]

    Deep learning face attributes in the wild

    Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. InICCV, pages 3730–3738. IEEE Computer Society, 2015

    2015

  11. [19]

    Dpm-solver: A fast ODE solver for diffusion probabilistic model sampling in around 10 steps

    Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver: A fast ODE solver for diffusion probabilistic model sampling in around 10 steps. InNeurIPS, 2022

    2022

  12. [20]

    MACE: mass concept erasure in diffusion models

    Shilin Lu, Zilan Wang, Leyang Li, Yanzhu Liu, and Adams Wai-Kin Kong. MACE: mass concept erasure in diffusion models. InCVPR, pages 6430–6440. IEEE, 2024

    2024

  13. [21]

    Sdedit: Guided image synthesis and editing with stochastic differential equations

    Chenlin Meng, Yutong He, Yang Song, Jiaming Song, Jiajun Wu, Jun-Yan Zhu, and Stefano Ermon. Sdedit: Guided image synthesis and editing with stochastic differential equations. InICLR. OpenRe- view.net, 2022

    2022

  14. [22]

    Diffeditor: Boosting accuracy and flexibility on diffusion- based image editing

    Chong Mou, Xintao Wang, Jiechong Song, Ying Shan, and Jian Zhang. Diffeditor: Boosting accuracy and flexibility on diffusion- based image editing. InCVPR, pages 8488–8497. IEEE, 2024

    2024

  15. [23]

    DALL·E 3: OpenAI’s Text-to-Image Generation Model

    OpenAI. DALL·E 3: OpenAI’s Text-to-Image Generation Model. ht tps://openai.com/dall-e-3, 2023. Accessed: 2025-04-14

    2023

  16. [24]

    Localization and manipulation of immoral visual cues for safe text- to-image generation

    Seongbeom Park, Suhong Moon, Seunghyun Park, and Jinkyu Kim. Localization and manipulation of immoral visual cues for safe text- to-image generation. InWACV, pages 4663–4672. IEEE, 2024

    2024

  17. [25]

    Direct unlearning optimization for robust and safe text-to-image models

    Yong-Hyun Park, Sangdoo Yun, Jin-Hwa Kim, Junho Kim, Geonhui Jang, Yonghyun Jeong, Junghyo Jo, and Gayoung Lee. Direct unlearning optimization for robust and safe text-to-image models. In NeurIPS, 2024

    2024

  18. [26]

    Pope Francis warns against ‘perverse’ dangers of AI, renews call for worldwide regulation — theglobeandmail.com

    Philip Pullella. Pope Francis warns against ‘perverse’ dangers of AI, renews call for worldwide regulation — theglobeandmail.com. https: //www.theglobeandmail.com/business/international-business/article-p ope-francis-warns-against-perverse-dangers-of-ai-renews-call-for/. Acces...

    2024

  19. [27]

    Learning transferable visual models from natural language supervi- sion

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervi- sion. InICML, volume 139...

    2021

  20. [28]

    Effects of deviations in the nose and chin prominence on facial attractiveness.Journal of Orthodontics, 48(2):135–143, 2021

    Navid Rezaei, Hoshyar Abbasi, Ali Khaksar, and Amin Golshah. Effects of deviations in the nose and chin prominence on facial attractiveness.Journal of Orthodontics, 48(2):135–143, 2021. PMID: 33546571

    2021

  21. [29]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. InCVPR, pages 10674–10685. IEEE, 2022

    2022

  22. [30]

    U-net: Con- volutional networks for biomedical image segmentation

    Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Con- volutional networks for biomedical image segmentation. In Nassir Navab, Joachim Hornegger, William M. Wells III, and Alejandro F. Frangi, editors,Medical Image Computing and Computer-Assisted Intervention - MICCAI...

    2015

  23. [31]

    Denton, Seyed Kamyar Seyed Ghasemipour, Raphael Gon- tijo Lopes, Burcu Karagol Ayan, Tim Salimans, Jonathan Ho, David J

    Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L. Denton, Seyed Kamyar Seyed Ghasemipour, Raphael Gon- tijo Lopes, Burcu Karagol Ayan, Tim Salimans, Jonathan Ho, David J. Fleet, and Mohammad Norouzi. Photorealistic text-to-image diffusion models with ...

    2022

  24. [32]

    Weiss, Niru Maheswaranathan, and Surya Ganguli

    Jascha Sohl-Dickstein, Eric A. Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In Francis R. Bach and David M. Blei, editors, Proceedings of the 32nd International Conference on Machine Learn- ing, ICML 2015, Lill...

    2015

  25. [33]

    Clare A. M. Sutherland, Xizi Liu, Lingshan Zhang, Yingtung Chu, Julian A. Oldmeadow, and Andrew W. Young. Facial first impres- sions across culture: Data-driven modeling of chinese and british perceivers’ unconstrained facial impressions.Personality and Social Psychology Bulle...

    2018

  26. [34]

    Globality strikes back: Rethinking the global knowledge of CLIP in training-free open- vocabulary semantic segmentation.arXiv preprint arXiv:2502.06818, 2025

    Jingyun Wang, Cilin Yan, and Guoliang Kang. Globality strikes back: Rethinking the global knowledge of CLIP in training-free open- vocabulary semantic segmentation.arXiv preprint arXiv:2502.06818, 2025

    2025 arXiv

  27. [35]

    Moderator: Moderating text-to-image diffusion models through fine-grained context-based policies

    Peiran Wang, Qiyu Li, Longxuan Yu, Ziyao Wang, Ang Li, and Haojian Jin. Moderator: Moderating text-to-image diffusion models through fine-grained context-based policies. InCCS, pages 1181–

  28. [36]

    AEIOU: A unified defense framework against NSFW prompts in text-to-image models.CoRR, abs/2412.18123, 2024

    Yiming Wang, Jiahao Chen, Qingming Li, Xing Yang, and Shouling Ji. AEIOU: A unified defense framework against NSFW prompts in text-to-image models.CoRR, abs/2412.18123, 2024

    2024

  29. [37]

    Unlearn- ing concepts in diffusion model via concept domain correction and concept preserving gradient

    Yongliang Wu, Shiji Zhou, Mingzhuo Yang, Lianzhe Wang, Heng Chang, Wenbo Zhu, Xinting Hu, Xiao Zhou, and Xu Yang. Unlearn- ing concepts in diffusion model via concept domain correction and concept preserving gradient. InAAAI, pages 8496–8504. AAAI Press, 2025

    2025

  30. [38]

    Editing massive concepts in text-to-image diffusion models

    Tianwei Xiong, Yue Wu, Enze Xie, Yue Wu, Zhenguo Li, and Xihui Liu. Editing massive concepts in text-to-image diffusion models. arXiv preprint arXiv:2403.13807, 2024

    2024

  31. [39]

    Guardt2i: Defending text-to-image models from adversarial prompts

    Yijun Yang, Ruiyuan Gao, Xiao Yang, Jianyuan Zhong, and Qiang Xu. Guardt2i: Defending text-to-image models from adversarial prompts. InNeurIPS, 2024

    2024

  32. [40]

    Safree: Training-free and adaptive guard for safe text-to- image and video generation.arXiv preprint arXiv:2410.12761, 2024

    Jaehong Yoon, Shoubin Yu, Vaidehi Patil, Huaxiu Yao, and Mohit Bansal. Safree: Training-free and adaptive guard for safe text-to- image and video generation.arXiv preprint arXiv:2410.12761, 2024

    2024 arXiv

  33. [41]

    Promptguard: Soft prompt-guided unsafe content moderation for text- to-image models.arXiv preprint arXiv:2501.03544, 2025

    Lingzhi Yuan, Xinfeng Li, Chejian Xu, Guanhong Tao, Xiaojun Jia, Yihao Huang, Wei Dong, Yang Liu, XiaoFeng Wang, and Bo Li. Promptguard: Soft prompt-guided unsafe content moderation for text- to-image models.arXiv preprint arXiv:2501.03544, 2025

    2025 arXiv

  34. [42]

    Forget-me-not: Learning to forget in text-to-image diffusion models

    Gong Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not: Learning to forget in text-to-image diffusion models. InCVPR Workshops, pages 1755–1764. IEEE, 2024

    2024

  35. [43]

    [CLS] attention is all you need for training-free visual token pruning: Make vlm inference faster.arXiv preprint arXiv:2412.01818, 2024

    Qizhe Zhang, Aosong Cheng, Ming Lu, Zhiyong Zhuo, Minqi Wang, Jiajun Cao, Shaobo Guo, Qi She, and Shanghang Zhang. [CLS] attention is all you need for training-free visual token pruning: Make vlm inference faster.arXiv preprint arXiv:2412.01818, 2024

    2024 arXiv

  36. [44]

    Efros, Eli Shechtman, and Oliver Wang

    Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. InCVPR, pages 586–595. Computer Vision Foundation / IEEE Computer Society, 2018

    2018

  37. [45]

    Defensive unlearning with adversarial training for robust concept erasure in diffusion models

    Yimeng Zhang, Xin Chen, Jinghan Jia, Yihua Zhang, Chongyu Fan, Jiancheng Liu, Mingyi Hong, Ke Ding, and Sijia Liu. Defensive unlearning with adversarial training for robust concept erasure in diffusion models. InNeurIPS, 2024. 14 Appendix We present the results of our reconstr...

    2024

  38. [2024]

    Accessed: 2024-09-15

    2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.