Visualerase improves safety by fully removing unwanted image concepts
VisualErase: Dual-Branch Visual Trajectory Redirection for Robust Concept Erasure in Text-to-Image Diffusion Models
Computer Vision and Pattern Recognition
Summary
Text-to-image generators can unintentionally recreate harmful or private images they learned from lots of data. Existing methods try to block these unwanted images by changing how the model connects words to pictures, but some hidden image details can still be found and recovered. The authors propose VisualErase, a new way that redirects the model’s image-making process to land on edited pictures where the unwanted parts are removed but everything else stays the same. This approach better blocks attacks trying to recover erased content while keeping the model good at making other images.
What this means in practice
- •For ai platform developers: Build safer image generation services by reliably removing harmful or copyrighted visual concepts from diffusion models.
- •For digital content compliance teams: Ensure that AI-generated images do not reproduce sensitive or prohibited concepts by deploying models with robust concept erasure.
Authors
Qianlong Xiang, Miao Zhang, Kun Wang, Yupeng Hu, Junhui Hou, Liqiang Nie
Abstract
Concept erasure is essential for the safe deployment of text-to-image diffusion models, as they may reproduce harmful, copyrighted, or privacy-sensitive content learned from unconstrained large-scale data. Existing methods typically erase unwanted concepts while preserving general generation capability by redirecting target-related text-to-image mappings. However, recent studies show that erased models may still retain visual generative trajectories of target concepts, leaving them vulnerable to adversarial recovery attacks and revealing a fundamental gap between redirecting text-to-image mappings and truly removing visual knowledge. To bridge this gap, we propose VisualErase, a new paradigm that redirects concept-bearing visual generative trajectories toward explicitly defined concept-removed outcomes. To enable this redirection, we use structure-preserving image editing to construct content-aligned, concept-removed counterparts for source images, providing explicit visual endpoints that retain non-target content. We then derive a denoising target from each source-to-counterpart pair and use a dual-branch redirection loss to align both text-conditioned and unconditional predictions with this target, since conditional supervision alone does not explicitly constrain generation without textual guidance. To mitigate the adverse effects of concept erasure on non-target generation, we jointly optimize the redirection loss with a counterpart retention loss that matches denoising predictions from the frozen pretrained model. Across style, celebrity, and nudity erasure, VisualErase limits the maximum attack success rate over seven attacks to 0%, 8%, and 0.1%, respectively, while retaining general generation quality. These results highlight the importance of visual trajectory redirection for robust concept erasure beyond text-to-image mappings alone.