Circumventing Concept Erasure Methods For Text-to-Image Generative Models

Authors: Minh Pham, Kelly O. Marshall, Niv Cohen, Govind Mittal, Chinmay Hegde

Published: 2023-08-03 02:34:01+00:00

AI Summary

This paper demonstrates that existing post-hoc concept erasure methods for text-to-image generative models are not fully effective. The authors introduce Concept Inversion (CI) attacks, which leverage special learned word embeddings to retrieve supposedly erased concepts from sanitized models without altering their weights. Their findings highlight the brittleness of these erasure techniques and call for stronger evaluation methodologies in AI safety for generative models.

Abstract

Text-to-image generative models can produce photo-realistic images for an extremely broad range of concepts, and their usage has proliferated widely among the general public. On the flip side, these models have numerous drawbacks, including their potential to generate images featuring sexually explicit content, mirror artistic styles without permission, or even hallucinate (or deepfake) the likenesses of celebrities. Consequently, various methods have been proposed in order to erase sensitive concepts from text-to-image models. In this work, we examine five recently proposed concept erasure methods, and show that targeted concepts are not fully excised from any of these methods. Specifically, we leverage the existence of special learned word embeddings that can retrieve erased concepts from the sanitized models with no alterations to their weights. Our results highlight the brittleness of post hoc concept erasure methods, and call into question their use in the algorithmic toolkit for AI safety.

Key findings

All seven investigated post-hoc concept erasure methods (ESD, SA, FMN, AC, UCE, NP, SLD) were successfully circumvented by Concept Inversion attacks, demonstrating that concepts are remapped rather than fully excised. The attacks effectively regenerated artistic styles, objects, identities, and NSFW content with high fidelity. This research underscores a fundamental brittleness in current erasure methods, indicating a need for new approaches and more robust evaluation protocols for safe generative AI.

Approach

The authors develop Concept Inversion (CI) attacks by devising an algorithm to learn special input word embeddings (soft prompts). These embeddings are optimized to counteract the mechanisms of various concept erasure methods, enabling the generation of supposedly 'erased' content from the sanitized text-to-image models without any retraining or modification of the model weights.

Datasets

I2P dataset, Imagenette, Google Images, MNIST, LAION-5B (for concept existence checks)

Model(s)

UNKNOWN

Author countries

USA, Israel

← Previous