~/shanegraffiti.com/research/forceforget Shane Graffiti Inc. Semantic Adversarial Research Division 2026

FORCE FORGET CONCEPT REMOVAL BY REWARD

§ 1.0

The Over-Erasure Problem

Removing an unsafe concept is easy to overdo. Strong erasers tend to take collateral with them, and because a concept like nudity is entangled with "human," aggressive removal degrades the model's ability to depict people at all. Three failure modes recur across prior methods.

Failure 01

Benign Suppression

Edited models also mitigate the safe concepts that happen to appear in a harmful prompt, stripping out neutral meaning along with the target.

+ real-world example

A prompt like "a person swimming in a lake" can lose the swimming/lake context entirely once the eraser strips anything associated with the unsafe concept — even though only one part of the prompt was ever unsafe.

Failure 02

Human-Content Drop

Because the unsafe concept is tied to people, the strongest erasers lose utility on ordinary human-oriented generation including recognisable faces.

+ real-world example

Some erasers degrade to the point where they can no longer render a recognizable human face at all, because the model can't separate "person" from the concept it was trained to remove.

Failure 03

I2I Leakage

Methods tuned for text-to-image often fail in image-to-image, where an unsafe input image can re-introduce the concept the eraser was meant to block.

+ real-world example

Feeding an already-unsafe photo back into the model for editing can cause the erased concept to reappear in the output, since the eraser was only trained against text prompts, not existing image content.

§ 2.0

Erasure as Reward Optimisation

Most erasers alter model weights through supervised fine-tuning, where the unsafe concept is hard to define crisply. ForceForget instead frames the problem as reinforcement learning: the model generates images, a reward scores them, and policy-gradient updates push generation toward safe content. Borrowing the DDPO recipe, it uses importance sampling with trust-region clipping to keep updates stable no ground-truth target images required.

RL objective maximise expected reward (hover any term) J(θ)The training objective itself — how good the current policy θ is, on average, at generating safe images. = EExpectation — average this quantity over every prompt and every image the model samples during training, not just one example._{c∼p(c)A training prompt c, drawn from the real distribution of prompts the model is trained on., x₀∼p_θ(x₀|c)A generated image x₀, sampled from the model's own current output distribution given that prompt.} [ r(x₀, c)The reward for that specific image — this is the Concept Erasing Reward, broken down in §3.0 below. ] // p_θ(x₀|c): sample distribution under the training-prompt distribution p(c) // policy-gradient update via importance sampling, clipped by a trust region (PPO-style) // the reward r(x₀, c) is the Concept Erasing Reward, defined next

§ 3.0

The Concept Erasing Reward

The reward is a balance of two opposing forces. A safety signal pushes generation away from the unsafe concept; an alignment signal anchors it to safe, human-oriented content so the model does not collapse into arbitrary output. Tuned together, they erase without over-erasing.

r_safe click to weight this signal higher

Safety Signal

A safety evaluator scores each generated image on safe-versus-unsafe classes; weighted scores form the reward. Positive means safe content, negative flags a likely violation steering updates toward the safe domain.

r_align click to weight this signal higher

Alignment Signal

An image captioner describes the output; sensitive keywords are filtered, and a CLIP score to the cleaned caption plus a target condition ("a photo of a person wearing clothing") keeps generation anchored to benign, human-oriented content.

← weighted toward r_safeweighted toward r_align →

click r_safe or r_align above to shift the weightbalanced (λ₁ = λ₂ = 1)

CER = 1 · r_safe + 1 · r_align

// both rewards rescaled to [0, 1] before summing, preventing collapse toward one objective
// balanced weights (λ₁ = λ₂ = 1) gave the best erasing in practice

§ 4.0

The Safe Adapter

Reward fine-tuning alone is slow to erase concepts thoroughly. The Safe Adapter accelerates it by regulating only part of the text embedding inside the cross-attention layers. The last few tokens are routed through a small learned linear layer while the rest pass through the usual LoRA projection letting the adapter dominantly absorb the unsafe concept so the bulk of the text feature stays focused on safe content.

§ 5.0

Erasing & Robustness

On the I2P benchmark, residual detections are counted by an automated detector across eight body-part classes; robustness is the removal rate under three red-teaming attacks; utility is held against the original SD v1.4 on COCO-30K. Lower residual and FID are better; higher attack-removal and CLIP are better.

I2P   residual detections · attack-removal rate (%) · benign utility

Method	Residual ↓	Ring-A-Bell ↑	MMA ↑	P4D ↑	CLIP ↑	FID ↓
SD v1.4 (base)	810	0.0	0.0	36.8	31.33	19.59
ESD	133	63.5	96.3	83.5	29.89	23.63
RECE	92	95.4	73.1	86.0	30.49	22.12
MACE	117	73.1	99.9	97.8	28.85	24.00
DuMo	45	99.7	96.4	97.8	30.59	28.96
Co-Erasing	53	73.3	97.2	85.3	30.35	26.97
ForceForget (this work)	38	100.0	100.0	99.6	30.53	26.73

Image-to-image transfer   removal rate (%) with nude / non-nude input

Method	Nude input ↑	Non-nude input ↑
ESD	12.4	87.2
SafeGen	18.8	59.2
RECE	28.6	60.6
MACE	8.4	91.0
Co-Erasing	9.8	93.8
ForceForget (this work)	96.4	100.0

100%

Removal under Ring-A-Bell & P4D

Residual detections lowest of all

90.7%

Celebrity-identity retention

96.4%

I2I removal with unsafe input

§ 6.0

Beyond One Concept

Dropping the safety signal and keeping only alignment turns the same machinery toward other erasure targets showing the approach is not specific to a single concept.

Artistic Style

Erasing "Van Gogh" or "Kelly McKernan" for copyright protection. ForceForget leads the overall trade-off score.

LSd 0.32 (Van Gogh), 0.26 (Kelly McKernan) — lowest of all compared methods, while untargeted styles like Picasso stay largely intact.

Objects

Removing whole object classes from Imagenette, steering gently toward a related object instead of scrambling to noise.

"Church" degrades toward a prayer-rug-like image; "English Springer" toward a generic dog — unrelated classes stay preserved.

Multiple Concepts

Fine-tuning to erase both "nudity" and "violence" generalises across the broader I2P inappropriate-content categories.

Lowers hate, harassment, self-harm, shocking, and illegal-activity content measured by a general inappropriateness classifier.

Other Backbones

Architecturally agnostic to the text encoder — transfers as a plug-in adapter without full retraining.

Applies to SDXL's dual-encoder embedding and transfers to SD v1.5 as a plug-in LoRA. Multimodal-attention models like FLUX would need further modification.

The stated limitation: a fixed reward weighting treats every unsafe prompt with the same erasing strength, which can over-erase mildly unsafe prompts or under-penalise highly unsafe ones a natural target for adaptive weighting in future work.

Architecturally agnostic to the text encoder — transfers as a plug-in adapter without full retraining.

Other Backbones

$ query: what breaks existing erasers // they over-erase taking benign concepts and human content with them. // and they leak in image-to-image settings. $ query: what does ForceForget change // erasure becomes a balanced reward: safety + alignment. // a Safe Adapter regulates only the last few text tokens. $ query: what is the result // 100% removal under Ring-A-Bell and P4D; lowest residual detections. // benign content, faces, and I2I robustness preserved.

FORCE FORGET CONCEPT REMOVAL BY REWARD

The Over-Erasure Problem

Erasure as Reward Optimisation

The Concept Erasing Reward

The Safe Adapter

Erasing & Robustness

Beyond One Concept

ERASE THE CONCEPT. KEEP THE MEANING.