用稀疏自编码器精准且持久擦除图像生成模型中的特定概念。
PEAK: Precise and Persistent Concept Erasure via k-Sparse Autoencoders
- 通过k-稀疏自编码器分解模型内部激活，定位目标概念的稀疏特征。
- 在I2P基准上将裸露检测率从582降至6，对抗攻击成功率从96.52%降至5.63%。
- 直接修改扩散参数实现持久擦除，无需推理时干预，适合版权与隐私保护场景。
由于版权侵权、隐私泄露和不当内容等问题日益突出，从大规模文本到图像扩散模型中擦除特定概念变得愈发重要。现有方法难以同时实现精确和持久的擦除：概念相关表示定位不准确会导致语义干扰，而知识未完全清除则可能被对抗性手段恢复。为此，我们提出PEAK框架，基于k-Sparse Autoencoders（kSAEs）实现精确且持久的概念擦除。PEAK首先在扩散去噪网络的内部激活上训练kSAE，将密集表示分解为可解释的稀疏特征。通过对比目标与非目标提示引发的稀疏激活，结合激活强度与频率，识别出一组紧凑的目标特异性特征。随后，利用这些特征指导参数优化，选择性抑制目标相关激活，同时保留互补的非目标部分以维持原始模型性能。该特征引导的优化将概念擦除直接嵌入扩散参数，无需推理时额外干预，有效抵御对抗攻击。大量实验表明，PEAK实现了高效且鲁棒的概念擦除。在I2P基准上，裸露内容检测数从582降至6，平均攻击成功率（ASR）由96.52%降至5.63%，在MS-COCO上保持生成质量，KID接近零。代码与模型已开源。
原文摘要 · Abstract (English)
Erasing concepts from large-scale text-to-image (T2I) diffusion models has become increasingly crucial due to the growing concerns over copyright infringement, privacy violations, and offensive content. Existing approaches struggle to achieve both precise and persistent concept erasure: inaccurate localization of concept-related representations may cause unintended semantic interference, while incomplete removal of the underlying concept knowledge allows adversarial recovery. To address this dilemma, we propose PEAK, a \textbf{\textit{precise}} and \textbf{\textit{persistent}} concept erasure framework via k-Sparse Autoencoders (kSAEs). PEAK first trains a kSAE on internal activations of the diffusion denoising network to decompose dense representations into interpretable sparse features. By contrasting sparse activations induced by target and non-target prompts, PEAK identifies a compact set of target-specific features according to both activation strength and frequency. These localized features are then used for parameter optimization, where PEAK selectively suppresses target-related activations while preserving complementary non-target ones towards the original model. This feature-guided optimization embeds concept erasure directly into diffusion parameters, eliminating the need for additional inference-time intervention and facilitating effective persistence against adversarial attacks. Extensive experiments demonstrate that PEAK achieves effective and robust concept erasure. On the I2P benchmark, PEAK reduces NudeNet detections from 582 to 6, lowers the average attack success rate (ASR) from 96.52\% to 5.63\%, and preserves general generation quality on MS-COCO with a near-zero KID. Our code and models are available at: https://github.com/manmanTAT/PEAK
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。