TRCE：迈向文本到图像扩散模型中的可靠恶意概念消除

TRCE: Towards Reliable Malicious Concept Erasure in Text-to-Image Diffusion Models

March 10, 2025

作者: Ruidong Chen, Honglin Guo, Lanjun Wang, Chenyu Zhang, Weizhi Nie, An-An Liu

cs.AI

摘要

近期，文本到图像扩散模型的进展实现了逼真图像的生成，但也带来了生成恶意内容（如NSFW图像）的风险。为降低风险，研究者们探索了概念消除方法，旨在使模型遗忘特定概念。然而，现有研究在完全消除隐含于提示中的恶意概念（如隐喻表达或对抗性提示）的同时，难以保持模型的正常生成能力。针对这一挑战，本研究提出了TRCE，采用两阶段概念消除策略，在可靠消除与知识保留之间实现有效平衡。首先，TRCE着手消除文本提示中隐含的恶意语义。通过识别关键映射目标（即[EoT]嵌入），我们优化交叉注意力层，将恶意提示映射至上下文相似但包含安全概念的提示。这一步骤防止模型在去噪过程中过度受恶意语义影响。随后，考虑到扩散模型采样轨迹的确定性特性，TRCE通过对比学习进一步引导早期去噪预测向安全方向偏离，远离不安全方向，从而进一步避免生成恶意内容。最后，我们在多个恶意概念消除基准上对TRCE进行了全面评估，结果表明其在消除恶意概念的同时，更好地保留了模型的原始生成能力。代码已发布于：http://github.com/ddgoodgood/TRCE。注意：本文包含模型生成内容，可能涉及冒犯性材料。

English

Recent advances in text-to-image diffusion models enable photorealistic image generation, but they also risk producing malicious content, such as NSFW images. To mitigate risk, concept erasure methods are studied to facilitate the model to unlearn specific concepts. However, current studies struggle to fully erase malicious concepts implicitly embedded in prompts (e.g., metaphorical expressions or adversarial prompts) while preserving the model's normal generation capability. To address this challenge, our study proposes TRCE, using a two-stage concept erasure strategy to achieve an effective trade-off between reliable erasure and knowledge preservation. Firstly, TRCE starts by erasing the malicious semantics implicitly embedded in textual prompts. By identifying a critical mapping objective(i.e., the [EoT] embedding), we optimize the cross-attention layers to map malicious prompts to contextually similar prompts but with safe concepts. This step prevents the model from being overly influenced by malicious semantics during the denoising process. Following this, considering the deterministic properties of the sampling trajectory of the diffusion model, TRCE further steers the early denoising prediction toward the safe direction and away from the unsafe one through contrastive learning, thus further avoiding the generation of malicious content. Finally, we conduct comprehensive evaluations of TRCE on multiple malicious concept erasure benchmarks, and the results demonstrate its effectiveness in erasing malicious concepts while better preserving the model's original generation ability. The code is available at: http://github.com/ddgoodgood/TRCE. CAUTION: This paper includes model-generated content that may contain offensive material.