To Erase, or Not to Erase: Robust Training-Free Concept Erasure with Preservation aware Adaptive Ranked Subspace Expansion

Concept erasure techniques (CETs) aim to remove specific, undesired concepts (such as NSFW content or copyrighted styles) from text-to-image diffusion models. A persistent challenge is the trade-off between robustness—preventing the target from re-emerging under adversarial or paraphrased prompts—and utility—maintaining the model's ability to generate high-quality images for benign, non-target concepts. This paper investigates how to achieve a better balance between these two competing goals.

The authors introduce Preservation-aware Adaptive Ranked Subspace Expansion (PARSE), a training-free framework that avoids the limitations of static, manually defined concept banks. PARSE operates in three key stages:

1. Diffusion-grounded Knowledge Search: Instead of relying on proxy embeddings, the model queries the diffusion process itself using classifier-free guidance to identify tokens that steer the model toward the target concept. It then filters these tokens using an image cache to ensure high precision.
2. Preservation-aware Projection: The method constructs a subspace projection in the cross-attention value space. Crucially, it ensures that the erased subspace is orthogonal to the 'retain' subspace, preventing the accidental suppression of benign concepts that share semantic similarities with the target.
3. Adaptive Subspace Expansion: PARSE iteratively searches for new 'triggers'—prompts that might cause the target to re-emerge—using textual inversion. It expands the erased subspace only when it identifies a strong trigger that does not conflict with the preserved retain semantics.

To evaluate these models, the authors propose the Balanced Erasure Utility Score (BEUS), a metric that uses the harmonic mean of normalized robustness (ASR) and utility (FID) scores to penalize imbalanced performance.

Experiments across NSFW, artistic style, and object erasure tasks demonstrate that PARSE consistently outperforms existing baselines. By dynamically building erase and retain banks and using a preservation-aware projection, PARSE maintains high generation quality (low FID) while significantly improving resistance to adversarial re-emergence attacks compared to static or less adaptive methods. The BEUS metric confirms that PARSE achieves a superior balance between robustness and utility across diverse categories.