Concept overlap limits erasing images in diffusion AI models
You Can't Have It Both Ways: Concept Entanglement Limits Diffusion Model Unlearning
Artificial Intelligence
Summary
This paper studies how AI models that generate images from text struggle to remove one concept without harming similar concepts. The researchers found that because concepts overlap in the model’s internal representations, completely removing one concept while keeping related ones intact is impossible. They mathematically prove a trade-off showing that the more two concepts overlap, the more removing one damages the other. Testing many existing methods confirms this trade-off, highlighting that some leakage or damage is inevitable.
What this means in practice
- •For ai product developers: Set realistic expectations for content removal features in AI image generators by accounting for unavoidable impacts on related concepts.
- •For software engineers: Evaluate and select diffusion model unlearning techniques based on the trade-off between removal strength and preservation of related concepts.
A theory result. No direct application yet.
Authors
Yian Wang, Ali Ebrahimpour-Boroojeny, Hari Sundaram, Varun Chandrasekaran
Abstract
Concept unlearning in text-to-image diffusion models aims to suppress a target concept (e.g., \texttt{horse}) while preserving related but distinct content (e.g., \texttt{donkey}), yet existing methods either leak under indirect prompts or visibly degrade other concepts. We show that these failure modes stem from the geometry of concept representations rather than from any particular algorithm. Formalizing concepts as activation-space regions, we prove that the overlap between a target and other concepts lower-bounds the damage any robust erasure must inflict on them, with the trade-off scaling linearly in the degree of overlap. Across thirteen unlearning methods, including methods designed to preserve non-target concepts, no method achieves both strong erasure and strong neighbor preservation: STEREO nearly eliminates indirect leakage but cuts neighbor generation by more than 75\%, while sparse inference-time methods preserve neighbors but leak. Damage increases with our overlap measure, monotonically so for STEREO; the $κ$-scaling reproduces on SDXL, and neighbor-selective damage recurs on FLUX. Perfect unlearning is the wrong target for entangled concepts; methods should be evaluated on the Pareto frontier our theorem establishes.