Growth Inhibitors for Suppressing Inappropriate Image Concepts in Diffusion Models

TL;DR

This paper tackles the risk of inappropriate content in diffusion-based image generation by addressing implicit unsafe prompts that bypass explicit word filters. It introduces Growth Inhibitors for Erasure (GIE), a non-finetuning approach that operates in the image space by extracting target-concept features from cross-attention maps and injecting growth inhibitors during the diffusion process to erase unwanted content. An adapter learns the optimal suppression scale from early attention statistics, enabling precise erasure across varying degrees and scopes of concepts and even enabling simultaneous suppression of multiple concepts. Across NSFW content, artistic styles, and common objects, GIE outperforms eight baselines in erasure fidelity while preserving image quality and semantic alignment, and it generalizes to unseen concepts with minimal training overhead.

Abstract

Despite their remarkable image generation capabilities, text-to-image diffusion models inadvertently learn inappropriate concepts from vast and unfiltered training data, which leads to various ethical and business risks. Specifically, model-generated images may exhibit not safe for work (NSFW) content and style copyright infringements. The prompts that result in these problems often do not include explicit unsafe words; instead, they contain obscure and associative terms, which are referred to as implicit unsafe prompts. Existing approaches directly fine-tune models under textual guidance to alter the cognition of the diffusion model, thereby erasing inappropriate concepts. This not only requires concept-specific fine-tuning but may also incur catastrophic forgetting. To address these issues, we explore the representation of inappropriate concepts in the image space and guide them towards more suitable ones by injecting growth inhibitors, which are tailored based on the identified features related to inappropriate concepts during the diffusion process. Additionally, due to the varying degrees and scopes of inappropriate concepts, we train an adapter to infer the corresponding suppression scale during the injection process. Our method effectively captures the manifestation of subtle words at the image level, enabling direct and efficient erasure of target concepts without the need for fine-tuning. Through extensive experimentation, we demonstrate that our approach achieves superior erasure results with little effect on other concepts while preserving image quality and semantics.

Figures (19)

• Figure 1: Visualization of the features for each token in the prompt and the features extracted for the target concept to be erased. Although there is no token in the implicit unsafe prompt that can capture inappropriate features, our method introduces "nude" as a target concept to guide inappropriate features into appropriate ones during the diffusion process. We also present the features extracted from adjectives that are synonymous with "nude", as well as its capitalized form and noun variant.
• Figure 2: Overview of the GIE model. The top figure illustrates that image features and text embeddings are fused in a cross-attention layer. The bottom figure describes the GIE framework. We introduce the target concept to be erased to calculate an attention map group $M^*$. Then, we extract a part of $M^*$ as the target feature for visualization. Our trained adapter can infer suppression scale to re-weight these features, thereby synthesizing a growth inhibitor $I$. By injecting $I$ before the [EOT] of the prompt's attention map group $M$, the target concept can be erased.
• Figure 3: The left part shows that weakening tokens irrelevant to the concept leads to unexpected results. The right part shows three examples of the same prompt. For different suppression scales, each cross-attention layer in the Stable Diffusion v1-4 (SD v1.4) model calculates different intermediate values at step 1. We use GPT-4o to select the image with the best erasure effect and quality among the images generated with different suppression scales. According to the regular changes shown in the plot and the labels given by GPT-4o, we train an adapter to automatically decide the optimal suppression scale.
• Figure 4: Erasure results of our GIE method and baselines in terms of NSFW removal rates w.r.t. the original SD v1.4 for target concept "nude".
• Figure 5: Examples of using GIE to erase NSFW content. For explicit and implicit unsafe prompts, GIE accurately erases the concept "nude" from generated images. We also give examples of using GIE to erase other NSFW concepts such as violence and horror.