Abstract
Text-to-image (T2I) diffusion models have shown exceptional capabilities in generating images that closely correspond to textual prompts. However, the advancement of T2I diffusion models presents significant risks, as the models could be exploited for malicious purposes, such as generating images with violence or nudity, or creating unauthorized portraits of public figures in inappropriate contexts. To mitigate these risks, concept removal methods have been proposed. These methods aim to modify diffusion models to prevent the generation of malicious and unwanted concepts. Despite these efforts, existing research faces several challenges: (1) a lack of consistent comparisons on a comprehensive dataset, (2) ineffective prompts in harmful and nudity concepts, (3) overlooked evaluation of the ability to generate the benign part within prompts containing malicious concepts. To address these gaps, we propose to benchmark the concept removal methods by introducing a new dataset, Six-CD, along with a novel evaluation metric. In this benchmark, we conduct a thorough evaluation of concept removals, with the experimental observations and discussions offering valuable insights in the field.
Introduction: The Risks of Generative AI
Text-to-image (T2I) diffusion models like Stable Diffusion have revolutionized content creation, but their ability to generate harmful content—ranging from nudity and violence to copyrighted characters—poses significant ethical and legal risks. While "concept removal" (CR) methods have emerged to sanitize these models, the lack of a standardized benchmark has made it difficult to assess their true effectiveness and the trade-offs they impose on model utility.
Addressing the Gaps in Current Evaluation
Existing research often suffers from three major issues. First, comparisons are inconsistent, typically focusing on narrow categories like art styles or nudity in isolation. Second, many benchmarks use "ineffective prompts" that wouldn't trigger the unwanted concept even in an unmodified model, leading to inflated success rates. Finally, the "retainability" problem is often overlooked: a model should be able to remove a specific concept (e.g., a celebrity) without losing the ability to generate the rest of the scene (e.g., the background or actions).
The Six-CD Methodology
To address these gaps, the authors introduced Six-CD, a comprehensive benchmark covering six categories: harmful content, nudity, celebrities, copyrighted characters, objects, and art styles.
A key innovation is the Dual-Version Dataset (DVD). For every malicious prompt, a benign counterpart is created. This allows for the calculation of the in-prompt CLIP score, measuring how well the model preserves the "safe" parts of a prompt after the target concept is removed.
The benchmark evaluates ten representative methods, categorized into fine-tuning-based approaches (gradient descent or closed-form solutions) and inference-time modifications. Fine-tuning methods like ESD or SPM modify model weights, while inference-time methods like SLD modify the generation process on the fly.
Key Insights and Results
The study reveals that "general" concepts like nudity and harm are significantly harder to remove than "specific" ones like individual celebrities. Specific concepts are often tied to explicit keywords, whereas general concepts can be triggered by diverse, implicit prompts.
As shown in the evaluation of nudity removal, most methods struggle as prompt effectiveness increases. While the "No CR" baseline shows high detection, methods like SLD and MACE show varying degrees of success. However, there is a clear "Retainability Trade-off": aggressive removal methods often accidentally erase benign context, degrading overall generation quality. MACE, for instance, was noted for a significant decrease in quality due to "over-locating" and erasing too much of the image.
Furthermore, inference-time methods face a "capacity limit." When tasked with removing dozens of concepts simultaneously, these methods often fail as they saturate the text encoder's embedding space. In contrast, closed-form fine-tuning methods proved more efficient and effective for large-scale concept removal.
Conclusion
Six-CD provides a rigorous framework for evaluating the safety of T2I models. By focusing on "effective prompts" and "in-prompt retainability," the benchmark ensures that safety measures do not inadvertently "lobotomize" these creative tools. Future work should continue to refine metrics for complex categories like art styles and focus on maintaining high generation quality while ensuring robust concept erasure.