PEAK: Precise and Persistent Concept Erasure via k-Sparse Autoencoders

2026-08-11

AI Summary

This work addresses the pressing challenges of copyright infringement, privacy violations, and harmful content generation in large text-to-image diffusion models by introducing a precise and persistent concept erasure method. The authors propose, for the first time, the use of k-sparse autoencoders to dissect internal model activations, enabling accurate identification of sparse features associated with target concepts. These features are then selectively suppressed through parameter optimization, embedding the erasure directly into the model weights—eliminating the need for inference-time interventions and providing robustness against adversarial recovery attempts. Evaluated on the I2P benchmark, the approach reduces detected NudeNet outputs from 582 to 6 and lowers attack success rates from 96.52% to 5.63%, while preserving high-fidelity image generation on MS-COCO, as evidenced by near-zero KID scores, substantially outperforming existing erasure techniques.

Abstract

Erasing concepts from large-scale text-to-image (T2I) diffusion models has become increasingly crucial due to the growing concerns over copyright infringement, privacy violations, and offensive content. Existing approaches struggle to achieve both precise and persistent concept erasure: inaccurate localization of concept-related representations may cause unintended semantic interference, while incomplete removal of the underlying concept knowledge allows adversarial recovery. To address this dilemma, we propose PEAK, a \textbf{\textit{precise}} and \textbf{\textit{persistent}} concept erasure framework via k-Sparse Autoencoders (kSAEs). PEAK first trains a kSAE on internal activations of the diffusion denoising network to decompose dense representations into interpretable sparse features. By contrasting sparse activations induced by target and non-target prompts, PEAK identifies a compact set of target-specific features according to both activation strength and frequency. These localized features are then used for parameter optimization, where PEAK selectively suppresses target-related activations while preserving complementary non-target ones towards the original model. This feature-guided optimization embeds concept erasure directly into diffusion parameters, eliminating the need for additional inference-time intervention and facilitating effective persistence against adversarial attacks. Extensive experiments demonstrate that PEAK achieves effective and robust concept erasure. On the I2P benchmark, PEAK reduces NudeNet detections from 582 to 6, lowers the average attack success rate (ASR) from 96.52\% to 5.63\%, and preserves general generation quality on MS-COCO with a near-zero KID. Our code and models are available at: https://github.com/manmanTAT/PEAK

Problem

• concept erasure
• diffusion models
• text-to-image generation
• adversarial recovery
• copyright infringement

Innovation

• k-Sparse Autoencoders
• concept erasure
• diffusion models
• feature localization
• adversarial robustness