CGCE: Classifier-Guided Concept Erasure in Generative Models

2024-11-15 · Source: cs.CV updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, extended

Summary

Classifier-Guided Concept Erasure (CGCE), a plug-and-play framework, provides robust concept erasure in generative models, addressing vulnerabilities to adversarial attacks and utility degradation. CGCE employs a lightweight classifier, trained on synthetic prompt pairs (e.g., 1000 for nudity), to detect and refine unsafe text embeddings at inference time. This approach modifies only harmful embeddings, preserving the original model's quality for benign prompts. Experiments demonstrate CGCE achieves leading robustness against red-teaming attacks like P4D, RAB, and MMAD, ranking first on four of six benchmarks for nudity removal on SD-v1.4. It also maintains high generative utility, with FID and CLIP scores nearly identical to the original model. CGCE is versatile, extending to T2I models like SD-v3, FLUX, Switti-AR, Infinity-2B, and T2V models such as CogVideoX-2B, CogVideoX-5B, and HunyuanVideo, supporting multi-concept erasure. Classifier training takes 440 seconds, significantly faster than fine-tuning methods.

Key takeaway

For AI Security Engineers or ML Engineers deploying generative models, if you are concerned about unsafe content generation and utility degradation, you should consider implementing Classifier-Guided Concept Erasure (CGCE). This plug-and-play framework offers leading robustness against red-teaming attacks for T2I and T2V models, while preserving original generative quality. You can efficiently remove multiple concepts by aggregating lightweight classifiers, avoiding costly model fine-tuning.

Key insights

CGCE robustly erases undesirable concepts from generative models by refining text embeddings at inference, preserving utility.

Principles

• Concept erasure can be robust and utility-preserving.
• Classifier-guided refinement in embedding space is effective.
• Multi-concept erasure is scalable via aggregated gradients.

Method

CGCE trains a lightweight classifier on LLM-generated safe/unsafe prompt pairs. At inference, it detects unsafe text embeddings and iteratively refines them using weighted gradient descent to steer away from harmful concepts.

In practice

• Apply CGCE to T2I/T2V models without weight modification.
• Use LLMs to generate diverse paired prompt datasets.
• Aggregate multiple classifiers for multi-concept removal.

Topics

• Concept Erasure
• Generative AI Safety
• Text-to-Image Models
• Text-to-Video Models
• Adversarial Robustness
• Diffusion Models

Code references

• InternLM/xtuner
• black-forest-labs/flux
• notAI-tech/NudeNet

Best for: Research Scientist, CTO, VP of Engineering/Data, AI Scientist, Machine Learning Engineer, AI Security Engineer

Related on AIssential

• TILDE: TILt-based Distributional Erasure for Concept Unlearning — Concept unlearning in diffusion models is best achieved by explicitly defining the desired post-unlearning distribution, not just suppressing concepts.
• Dataset filtering provides only limited protection against CSAM generation in text-to-image models, study finds — Dataset filtering alone offers limited defense against CSAM generation in text-to-image models.
• GPE: Evaluating Robust Evidence Aggregation for Fact Verification under Controllable GEO-Style Poisoning — Generative Engine Optimization (GEO) poisoning degrades LLM fact verification, necessitating adversarial evaluation benchmarks.
• Uni-AdaVD: Universal Concept Erasure for Visual Generation via Orthogonal Value Decomposition — Uni-AdaVD offers a universal, inference-time method to erase undesirable concepts from visual generative models without retraining.
• TRACER: Token ReAssignment for Concept ERasure in Generative Recommendation — Generative recommendation unlearning requires token reassignment to resolve conflicts from shared semantic IDs, preserving utility.
• Detoxifying LLMs via Representation Erasure-Based Preference Optimization — REPO robustly detoxifies LLMs by erasing toxic representations at a token level, resisting adaptive attacks.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.CV updates on arXiv.org.