OrthoEraser: Coupled-Neuron Orthogonal Projection for Concept Erasure

Conference: ECCV2026
Paper: ECCV Paper
Area: Image Generation
Keywords: concept erasure, sparse autoencoders, coupled neurons, orthogonal projection, semantic preservation

TL;DR

OrthoEraser identifies sensitive features and the benign features affected by their removal, then subtracts only the sensitive direction orthogonal to a protected subspace, reducing SD1.4's total NudeNet detections on I2P from 646 to 5 while retaining near-original text alignment and output distributions on COCO prompts.

Background & Motivation

Concept erasure in text-to-image models is not merely about disabling a word: it must restrict generation of designated content while preserving normal behavior on other prompts. ESD fine-tunes the model with negative guidance, UCE performs closed-form editing, and SNCE narrows intervention to a small set of critical neurons. These approaches improve localization, but modifying fewer neurons does not necessarily mean affecting fewer semantics. For example, an internal direction carrying a target attribute may also contribute to appearance, pose, or background; weakening it directly can change otherwise benign images. Erasure effectiveness and damage to normal generation must therefore be evaluated together, rather than judging success solely by lower sensitive-content detection counts.

The paper interprets this collateral damage as a geometric consequence of feature superposition: sensitive and benign semantic directions need not be orthogonal. A sparse autoencoder (SAE) expands dense activations into more identifiable sparse features, but its decoder vectors can still overlap. Even after correctly identifying sensitive features, directly subtracting their decoder contributions may change other features when the edited state is re-encoded. This motivates a step beyond localization followed by zeroing: identify both what to remove and which benign features a temporary intervention puts at risk. The protected features are selected through observed activation changes, rather than assuming that every non-sensitive direction deserves equal protection.

The authors consequently formulate erasure as a vector operation constrained by a protected subspace. Only the component of the sensitive direction outside that subspace is removed; its shared component is not directly deleted. This gives local preservation a precise mathematical meaning, while leaving an empirical question: after retaining shared components, is the remaining removable direction strong enough to suppress the target content? Core Idea: use zero-ablation to identify benign neurons vulnerable to sensitive-feature removal, then project the erasure vector onto the orthogonal complement of their span to change target content while minimizing disturbance to normal generation.

Method

Overall Architecture

Preparation takes a pretrained generative model, paired sensitive and non-sensitive prompts, and intermediate activations extracted from them. The method proceeds through sensitive neuron localization, coupled neuron detection, and orthogonal projection suppression; the first two establish intervention locations and protected features, while the last edits activations during inference. The original generative model still produces the output: this is neither pixel-level masking after generation nor a separately trained image restoration model. Figure 2 depicts an intervention on the text-encoding side; the dense states and SAE features below belong to that representation space, not the final image pixels.

%%{init: {'flowchart': {'rankSpacing': 24, 'nodeSpacing': 28, 'padding': 6, 'wrappingWidth': 400}}}%%
flowchart TD
    Prompts["Paired prompts and model activations"] --> Locate["Sensitive neuron localization"]
    Locate --> Detect["Coupled neuron detection"]
    Detect -->|Protected basis and sensitive set| Project["Orthogonal projection suppression"]
    Current["Current inference activations"] --> Project
    Project --> Generate["Continue through the original generative model"]

The SAE encodes a dense state \(h\) into sparse coefficients \(z\), with each nonzero coefficient contributing a feature direction through its decoder vector. The sensitive set records which SAE features to intervene on, while the coupled set records which non-sensitive features are most vulnerable to collateral changes. Their roles differ: coupled features are not a second group of erasure targets, but protected features constraining the erasure direction. Sets and the protected basis obtained during calibration can be used at inference, whereas the sensitive direction's magnitude depends on the current input activations. The method therefore does not subtract an identical fixed vector from every prompt, nor does it require a manually paired benign prompt at inference time.

Key Designs

1. Sensitive neuron localization: find the layer with the clearest signal, then compare differential sparse-feature responses

Layer selection uses target-related attention signals rather than an arbitrarily chosen deep layer. The authors average attention heads and measure mean attention from sensitive modifier tokens to target entity nouns, calling this sensitive attention, or SA. Because SA alone may reflect global changes caused by prompt rewriting, they also compare attention over non-target tokens between paired prompts to obtain contextual disturbance, or CD. The textual definition of the sensitive score, SS, averages sensitive-prompt SA minus the corresponding CD across prompt pairs, emphasizing target signal relative to background disturbance. They select the global SS maximum; Figure 3 identifies layer 10 in the reported setup, rather than layer 3, where the first local peak appears. The cached rendering of Equations (1) through (3) is damaged, particularly the indexing and norm for CD, so no reconstructed expression is presented here as the authors' exact formula.

After selecting the layer, an SAE expands its dense activations into sparse features instead of treating raw channels as independent concepts. A feature's weighted frequency score, WFS, multiplies activation frequency by mean activation magnitude, accounting for both how often it appears and how strongly it responds. The method compares WFS between sensitive and non-sensitive prompt sets and selects the Top-K features with the largest differences as the sensitive set. A generic feature active across all person-related prompts is thus not classified as a sensitive concept carrier solely because it has large magnitude. The subtraction sign in Equation (5) is missing from the extracted text, but the surrounding prose explicitly describes differential activation; this note uses that textual definition only. The sensitive-set Top-K is not the same hyperparameter as the Top-K sparsity gate inside the SAE encoder.

2. Coupled neuron detection: use temporary removal to find the benign features that are actually affected

Knowing the sensitive set does not reveal what its removal will damage, so the authors perform a diagnostic zero-ablation. For a sensitive prompt, they obtain the original state \(h\) and sparse coefficients \(z\), then subtract all active sensitive features' decoder contributions from \(h\). This operation takes place in dense space; the analysis does not stop after setting a few entries in a sparse array to zero. Equation (6) expresses it as:

\[ h' = h - \sum_{i\in\mathcal{N}_{\mathrm{sens}}} z_i w_i^{\mathrm{dec}}. \]

The edited state \(h'\) is then passed through the same SAE encoder to observe changes in other features relative to their original activations. If decoder directions were entirely non-interfering, removing the target contribution should not substantially change non-target features; observed changes expose coupling in the representation. The paper defines a benign neuron's coupling strength as the expected absolute activation difference before and after removal over sensitive prompts. The Top-k non-sensitive features with the largest changes form the coupled set \(\mathcal C\); the lowercase \(k\) controls how many features are protected. A large change indicates sensitivity to this removal, not automatically an independently meaningful semantic label verified by humans. Temporary zeroing is a diagnostic operation for constructing empirical protection constraints, not the final image-generation intervention.

3. Orthogonal projection suppression: subtract only the sensitive component outside protected directions

The coupled neurons' decoder vectors are collected as columns of \(W_{\mathcal C}\), and QR decomposition produces an orthonormal basis \(Q\) spanning the same protected subspace. With this basis, \(QQ^\top\) projects a dense vector onto that protected subspace. At inference, the current sensitive-neuron activations form a raw sensitive direction, whose component inside the protected subspace is then removed. The central transformations clearly preserved in Equations (9) and (10) are:

\[ d_{\mathrm{raw}} = \sum_{i\in\mathcal{N}_{\mathrm{sens}}} z_i w_i^{\mathrm{dec}}, \qquad d^* = (I-QQ^\top)d_{\mathrm{raw}}. \]

Finally, the method subtracts \(d^*\) scaled by intervention strength \(\lambda\) from the current state and returns the edited state to the generative model. Despite the term "gradient orthogonalization," the concrete operation analytically projects an activation-contribution vector rather than performing additional gradient descent on the generator. The projection directly implies \(Q^\top d^*=0\), so this subtraction leaves the current state's linear projection onto the selected protected basis unchanged. This is a local property of the projection formula, not a guarantee that every benign neuron activation or the full nonlinear generation process remains unchanged. In particular, SAE encoder directions need not equal decoder directions, and later layers include nonlinear operations; preserving image quality through decoder-subspace protection remains an empirical claim. If the sensitive direction lies almost entirely inside the protected subspace, little remains to subtract, exposing a genuine conflict between erasure and protection under strong entanglement.

A Worked Example

A pair of prompts describing the same person and scene but differing in the target attribute illustrates calibration; this is a procedural explanation, not a new experimental sample. The pair helps separate generic person-related responses from target-attribute responses, with differential sparse features at layer 10 becoming candidate sensitive features. Their contributions are temporarily removed, and benign features whose re-encoded activations change substantially become priority candidates for protection. For a new inference prompt, the system does not simply repeat that diagnostic deletion: it splits the current sensitive contribution into components parallel and perpendicular to the protected subspace. Only the latter is scaled and subtracted, aiming to restrict the target attribute while retaining normal structures associated with the former. The authors choose \(\lambda=3\) in their scaling analysis; this controls intervention strength and does not mean that 3 sensitive neurons were selected.

Loss & Training

Main experiments use Stable Diffusion 1.4; an auxiliary Top-K SAE must be trained, so the complete procedure is not training-free. The SAE has an expansion factor of 4 and hidden dimension 3072, and is trained with mean squared reconstruction error. The optimizer is Adam with learning rate \(4\times10^{-4}\) and batch size 4096; experiments run on a single NVIDIA A6000. Safety intervention in the generator uses analytical projection and inference-time activation editing; the main text does not specify an additional generator fine-tuning objective. Figure 10 and the discussion on page 14 describe residual target content for \(\lambda<3\) and increasing semantic drift above 3, motivating the choice of 3. This is primarily qualitative sensitivity evidence, not proof of a universal optimal threshold across models, concepts, or prompts. The main text does not clearly specify the sensitive-set Top-K, coupled-set Top-k, SAE training steps, or complete calibration-data size, leaving reproduction details unresolved.

Key Experimental Results

Main Results

The following representative methods come from Table 1 on page 8: safety is measured by total NudeNet detections on I2P, where lower is better. Normal generation uses MS COCO-30K prompts: higher CLIP Score (CS) is better, and lower FID indicates an output distribution closer to the original SD1.4. The FID reference is the original model's generated distribution, not the standard comparison against real COCO images; the source table leaves the original model's FID unreported.

Method	I2P total detections, lower is better	COCO CS, higher is better	FID relative to original model, lower is better
SD1.4	646	31.34	Not reported
ESD	121	30.90	16.88
UCE	186	29.92	22.87
SPM	56	31.01	16.64
SNCE	17	30.87	16.64
OrthoEraser	5	31.33	1.15

Compared with SNCE, OrthoEraser reduces detections from 17 to 5 while lowering FID relative to the original model from 16.64 to 1.15. This supports stronger erasure without greater benign-distribution drift, but 5 denotes detection events, not 5% or a human-certified count of unsafe images.

Ablation Study

The following intervention analysis combines Tables 3 and 4 on page 11 under the same metric setup as the main comparison; identical configurations are not repeated. "Coupled-aligned suppression" and "only coupled suppression" are separately reported strategies and must not be assigned the same numbers merely because their names are similar.

Config	Source	I2P total detections, lower is better	CS, higher is better	FID, lower is better
Direct sensitive suppression	Table 3 / Table 4	17	30.87	16.64
Coupled-aligned suppression	Table 3	12	26.31	23.95
Only coupled suppression	Table 4	604	29.95	25.86
OrthoEraser	Table 3 / Table 4	5	31.33	1.15

Suppressing only coupled neurons barely addresses the target content while substantially shifting the original generation distribution, showing why protected features should not become another erasure target set. Table 2 on page 9 additionally reports 17, 24, and 5 detections at layers 9, 3, and 10, respectively, supporting the importance of intervention-layer selection. Its parenthetical description conflicts with the displayed values, and 24 at layer 3 does not match the reported difference of -632; only detection totals are quoted here, not those differences.

Key Findings

Table 5 on page 13 extends evaluation to violent-content detection and adversarial prompts; selected methods are shown below, with all columns expressed as percentages and lower being better. Violent content is evaluated with Q16, while the P4D and Ring-A-Bell columns report attack success rate (ASR).

Method	I2P Violence, lower is better	P4D ASR, lower is better	Ring-A-Bell ASR, lower is better
SD1.4	40.1	98.7	83.1
RECE	14.2	64.7	13.4
SNCE	17.7	42.6	6.3
OrthoEraser	15.6	34.6	2.7

OrthoEraser outperforms these comparisons on the two adversarial evaluations, but not RECE's 14.2% on violent content, so it is not best on every safety metric. The prose on page 13 swaps the original-model baselines of 98.7% and 83.1% between the attack datasets; this note follows Table 5's column headings while explicitly retaining the discrepancy. Figures 5 and 6 and the discussion on pages 10 through 11 report 598 detections after random suppression and 691 after target-feature amplification, supporting the identified features' involvement in target-content generation. The cross-model discussion on page 14 reports reductions of 213, 183, and 76 detections for FLUX.1 Dev, AltDiffusion, and Show-o2, respectively, with CS decreases of 0.02 to 0.03; these are reductions, not final detection counts.

Highlights & Insights

• Re-encoding after intervention provides a diagnostic closer to "what does removing this direction damage?" than static correlation alone; it supplies an operational basis for choosing protected features.
• Protection concerns a finite subspace rather than the entire model, making the orthogonality constraint implementable with QR decomposition and giving the intervention a checkable local algebraic property.
• The erasure vector follows current activations while the protected basis comes from calibration, clearly separating their roles without retraining the generator for each new prompt.

Limitations & Future Work

• Local orthogonality guarantees neither global semantic invariance nor unchanged encoder features; layerwise propagation and encoder-response analyses would establish how far decoder-space protection carries through the model.
• The protected set depends on calibration prompts and Top-k, but its coverage and rank sensitivity are insufficiently reported; out-of-distribution concepts may affect benign features outside this set.
• P4D ASR remains 34.6%, indicating risk reduction under finite evaluations rather than proof of irreversible forgetting or resistance to every bypass.
• FID mainly measures proximity to the original model, not improvements in its intrinsic quality or biases; human assessment, repeated trials, and uncertainty reporting are still needed.
• These reproduction gaps and mathematical boundaries are reader analysis; the authors mainly emphasize the empirical safety-fidelity trade-off and do not provide a dedicated systematic limitations section.

Related Work & Insights

• Compared with ESD and UCE: source references [10] and [12] represent negative-guidance fine-tuning and unified concept editing; OrthoEraser focuses on activation intervention directions rather than strengthening erasure through larger parameter changes.
• Compared with SNCE: source reference [16], A Single Neuron Works: Precise Concept Erasure in Text-to-Image Diffusion Models, emphasizes critical-neuron localization; OrthoEraser additionally addresses collateral effects on benign features after localization.
• Compared with SAE-based concept unlearning: source reference [7], SAeUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders, provides the sparse-feature intervention background; OrthoEraser adds coupling detection and protected-subspace constraints.
• Research implication: selecting protected features through intervention responses could inform other model-editing tasks, but semantic labels, protected subspaces, and downstream outputs must be revalidated rather than inheriting this paper's preservation claims unchanged.

Rating

• Novelty: 4/5. Coupling detection and analytical projection address the protection problem left after sensitive-feature localization.
• Experimental Thoroughness: 4/5. Main comparisons, intervention ablations, and cross-model evaluations are substantial, but hyperparameter details, uncertainty, and runtime costs are underreported.
• Writing Quality: 3/5. The main argument is clear, but numerical correspondence conflicts between tables and prose, and some strong preservation language exceeds the local derivation.
• Value: 4/5. Useful for studying concept erasure with limited collateral damage in image generation, but not a complete deployment-safety guarantee.