Text-to-image models can still produce unsafe content, and existing concept-erasing methods tend to over-correct suppressing the benign concepts that share a prompt with a harmful one and degrading the model's ability to depict people at all. ForceForget reframes erasure as reward optimisation under reinforcement learning: it eliminates an unsafe concept while preserving safe semantic meaning, by maximising a Concept Erasing Reward that balances a safety signal against an alignment signal. A lightweight Safe Adapter regulates only part of the text embedding inside cross-attention for efficient, targeted removal. This is safety research the goal is a model that refuses to generate the unsafe concept while remaining useful everywhere else.
Removing an unsafe concept is easy to overdo. Strong erasers tend to take collateral with them, and because a concept like nudity is entangled with "human," aggressive removal degrades the model's ability to depict people at all. Three failure modes recur across prior methods.
Most erasers alter model weights through supervised fine-tuning, where the unsafe concept is hard to define crisply. ForceForget instead frames the problem as reinforcement learning: the model generates images, a reward scores them, and policy-gradient updates push generation toward safe content. Borrowing the DDPO recipe, it uses importance sampling with trust-region clipping to keep updates stable no ground-truth target images required.
The reward is a balance of two opposing forces. A safety signal pushes generation away from the unsafe concept; an alignment signal anchors it to safe, human-oriented content so the model does not collapse into arbitrary output. Tuned together, they erase without over-erasing.
Reward fine-tuning alone is slow to erase concepts thoroughly. The Safe Adapter accelerates it by regulating only part of the text embedding inside the cross-attention layers. The last few tokens are routed through a small learned linear layer while the rest pass through the usual LoRA projection letting the adapter dominantly absorb the unsafe concept so the bulk of the text feature stays focused on safe content.
// CLIP text sequence (77 tokens, truncated above) only the last 4 tokens route through the Safe Adapter
// front tokens carry the prompt's core meaning; transforming the tail erases broadly while preserving safe alignment
On the I2P benchmark, residual detections are counted by an automated detector across eight body-part classes; robustness is the removal rate under three red-teaming attacks; utility is held against the original SD v1.4 on COCO-30K. Lower residual and FID are better; higher attack-removal and CLIP are better.
| Method | Residual ↓ | Ring-A-Bell ↑ | MMA ↑ | P4D ↑ | CLIP ↑ | FID ↓ |
|---|---|---|---|---|---|---|
| SD v1.4 (base) | 810 | 0.0 | 0.0 | 36.8 | 31.33 | 19.59 |
| ESD | 133 | 63.5 | 96.3 | 83.5 | 29.89 | 23.63 |
| RECE | 92 | 95.4 | 73.1 | 86.0 | 30.49 | 22.12 |
| MACE | 117 | 73.1 | 99.9 | 97.8 | 28.85 | 24.00 |
| DuMo | 45 | 99.7 | 96.4 | 97.8 | 30.59 | 28.96 |
| Co-Erasing | 53 | 73.3 | 97.2 | 85.3 | 30.35 | 26.97 |
| ForceForget (this work) | 38 | 100.0 | 100.0 | 99.6 | 30.53 | 26.73 |
| Method | Nude input ↑ | Non-nude input ↑ |
|---|---|---|
| ESD | 12.4 | 87.2 |
| SafeGen | 18.8 | 59.2 |
| RECE | 28.6 | 60.6 |
| MACE | 8.4 | 91.0 |
| Co-Erasing | 9.8 | 93.8 |
| ForceForget (this work) | 96.4 | 100.0 |
Dropping the safety signal and keeping only alignment turns the same machinery toward other erasure targets showing the approach is not specific to a single concept.
The stated limitation: a fixed reward weighting treats every unsafe prompt with the same erasing strength, which can over-erase mildly unsafe prompts or under-penalise highly unsafe ones a natural target for adaptive weighting in future work.
ERASE
THE
CONCEPT.
KEEP
THE
MEANING.