🤖 AI

Look But Don't Touch with Sparse Autoencoders for Unlearning in Diffusion Models

This paper demonstrates that while Sparse Autoencoders effectively detect semantic concepts in diffusion models, direct latent intervention using these features causes visual artifacts, prompting a detection-based replacement strategy that achieves superior object erasure by preserving the model's activation statistics.

Original authors: Enrico Cassano, Riccardo Renzulli, Rayyan Ahmed, Marco Grangetto, Stephan Alaniz

Published 2026-07-01

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Enrico Cassano, Riccardo Renzulli, Rayyan Ahmed, Marco Grangetto, Stephan Alaniz

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a magical paintbrush (a Diffusion Model) that can create any picture you can describe. But sometimes, you want to teach this brush to forget how to paint specific things, like horses or copyrighted characters, without having to retrain the whole artist from scratch. This process is called "unlearning."

Recently, researchers tried to use a special tool called a Sparse Autoencoder (SAE) to help. Think of the SAE as a highly organized librarian who can look at the artist's brain (the model's internal data) and point exactly to the specific "thoughts" or "neurons" responsible for drawing a horse.

The Problem: "Look But Don't Touch"

The researchers tried a strategy where they told the artist: "Hey, I see you're thinking about a horse. Stop thinking about it!" They tried to do this by directly turning down the volume on those specific "horse thoughts" inside the artist's brain.

The result was a disaster.

The paper calls this "Look But Don't Touch."

Look: The SAE was excellent at finding the horse thoughts. It knew exactly where they were.
Don't Touch: When they tried to change those thoughts, the artist's brain got confused. The "horse thoughts" were replaced with random, out-of-distribution noise.

The Analogy: Imagine you are editing a movie. You find the exact frame where a horse appears. Instead of just cutting the horse out, you try to "subtract" the horse's color from the entire film reel. The result isn't a clean scene without a horse; it's a glitchy, distorted mess where the sky turns purple and the grass looks like static. The artist's brain was pushed into a state it had never seen before, creating severe visual artifacts (glitches).

The Solution: Patch Embedding Replacement (PER)

The authors realized that while the SAE is a terrible "eraser," it is a fantastic "spotter." So, they changed the strategy completely.

Instead of trying to manipulate the internal thoughts of the artist, they used the SAE only to find the horse. Once the SAE said, "There is a horse in this specific patch of the image," the researchers simply swapped that patch with a clean patch from the same image that didn't have a horse.

The Analogy:
Imagine you are editing a photo of a crowded park, and you want to remove a specific person (the horse).

The Old Way (Steering): You try to use a magic wand to "un-invent" the person. The wand glitches, and the person's face melts into the background, ruining the whole photo.
The New Way (PER): You use the SAE to point a finger at the person. Then, you take a clean, empty piece of grass from another part of the same photo and paste it over the person. Because you are using a piece of the photo that already exists and fits perfectly, the result looks natural. No glitches, no weird colors.

Key Findings

Detection is Easy, Manipulation is Hard: The paper proves that while SAEs are great at identifying what is in the image, they are terrible at directly controlling the model to remove it. Direct manipulation breaks the model's internal logic.
The "Swap" Works Better: By using the SAE only to find the target and then swapping the image pieces (patches) instead of tweaking the math, the results are much cleaner.
No More Guessing: Old methods required a tedious "grid search" (trying dozens of different strength settings) to see how much to turn down the "horse thoughts." The new method works automatically without this trial-and-error.
Better Results: On a test called "UnlearnCanvas," their new method produced images that were significantly less glitchy (fewer artifacts) and kept other parts of the image (like the style or background) intact much better than previous methods.

Summary

The paper teaches us a valuable lesson in AI control: Just because you can find a concept inside a model doesn't mean you should try to directly edit it. Sometimes, the best way to remove something is to let the AI do its job, spot the unwanted item, and simply replace that specific part with something that already fits, rather than trying to force the AI's brain to "un-think" the concept.

Technical Summary: Look But Don't Touch with Sparse Autoencoders for Unlearning in Diffusion Models

Problem Statement

The paper addresses the challenge of machine unlearning in diffusion models (DMs), specifically the selective erasure of unwanted concepts (e.g., specific objects or styles) without retraining the model. While Sparse Autoencoders (SAEs) have emerged as promising tools for concept-level manipulation due to their ability to decompose dense neural activations into sparse, monosemantic features, their application in DMs faces a critical failure mode.

Existing SAE-based unlearning methods typically follow a pipeline where SAE latents representing a target concept are identified and then steered (manipulated via negative multipliers) to suppress the concept. The authors observe that this direct intervention frequently induces out-of-distribution (OOD) activations. Because the manipulated latent vectors do not lie on the diffusion model's learned manifold, the reconstruction process generates severe visual artifacts, degrading image quality and undermining the unlearning objective. The core problem is the gap between concept detection (which SAEs perform well) and concept intervention (where SAEs fail in DMs).

Methodology

The authors propose a framework called Patch Embedding Replacement (PER) to disentangle detection from intervention. Instead of manipulating the latent space directly, PER uses SAEs solely as semantic detectors.

1. SAE Training and Concept Identification

SAE Architecture: The authors apply SAEs to the residual stream of cross-attention layers in the denoising network of DMs (e.g., Stable Diffusion v1.5, SDXL Turbo). They utilize TopK SAEs, which enforce sparsity by retaining only the top $k$ activated latents, ensuring a fixed sparsity level.
Concept-Latent Mapping: A score-based analysis identifies which SAE latents correspond to specific concepts. Latents are ranked based on their activation frequency in datasets containing the target concept versus those without it.
Detection Mask: During inference, a binary detection mask $M^c$ is generated for a target concept $c$ . A spatial location $(h, w)$ is marked as containing the concept if at least one associated latent exceeds its mean activation threshold on a validation set.

2. Patch Embedding Replacement (PER)

Rather than applying a negative multiplier to the SAE latents (which causes OOD shifts), PER replaces the problematic data directly in the feature map:

Replacement Strategy: For every patch embedding $\mathbf{X}_{h,w}$ where the detection mask $M^c_{h,w} = 1$ , the embedding is replaced with an embedding $\mathbf{X}_{h',w'}$ sampled uniformly from locations where the concept is not detected ( $M^c_{h',w'} = 0$ ).
Mathematical Formulation:
$\tilde{\mathbf{X}}_{h,w} = (1 - \mathbf{M}^c_{h,w})\mathbf{X}_{h,w} + \mathbf{M}^c_{h,w}\mathbf{X}_{h',w'}$
where $(h', w') \sim \mathcal{U}(\{(i, j) \mid \mathbf{M}^c_{i,j} = 0\})$ .
Dilation: To account for spatial correlations where concept information bleeds into neighboring patches, the detection mask can be dilated by a padding factor $p$ . The authors find $p=1$ to be the optimal balance between coverage and preserving unrelated content.
In-Distribution Guarantee: Since all replacement activations originate from the same forward pass of the denoising network, the resulting activations $\tilde{\mathbf{X}}$ remain strictly in-distribution (ID), preserving the model's activation statistics and avoiding the artifacts caused by OOD steering.

Key Contributions

Identification of Failure Modes: The paper systematically characterizes a concrete failure mode in SAE-based unlearning for DMs: direct latent steering via negative multipliers pushes activations outside the DM's training manifold, resulting in systematic visual artifacts.
Detection-Based Framework (PER): The authors introduce PER, a method that leverages SAEs exclusively for concept localization. By replacing detected patch embeddings with concept-free embeddings from the same feature map, PER removes unwanted concepts while maintaining visual coherence and distributional integrity.
Performance Improvements: The method eliminates the need for costly grid searches for intervention strength ( $\gamma$ ) and achieves state-of-the-art results on the UnlearnCanvas benchmark.

Experimental Results

The authors evaluated PER on four existing SAE-based pipelines (SAeUron, SAEmnesia, G-SAE, and SAE on SDXL Turbo) across the UnlearnCanvas benchmark (20 object classes, 5 artistic styles).

Artifact Reduction: Multiplier-based steering methods produced high Artifact Rates (AR) (e.g., 57.0% for SAeUron, 61.0% for SAE on SDXL Turbo). Applying PER drastically reduced these rates (e.g., down to 16.3% for SAeUron and 8.0% for SDXL Turbo).
Unlearning Accuracy: PER maintained or improved Unlearning Accuracy (UA) while significantly boosting Cross-domain Retain Accuracy (CRA). For instance, on SAEmnesia, PER improved the Global Average (GA) score from 81.18% to 91.44%, driven largely by a CRA increase from 88.48% to 97.97%.
Human Evaluation: In a user study comparing SAEmnesia and SAEmnesia+PER, human annotators preferred the PER output in 95.5% of non-tie cases.
Adversarial Robustness: PER demonstrated competitive robustness against adversarial attacks (UnlearnDiffAtk), showing smaller degradation in unlearning effectiveness compared to baselines in certain configurations.
Efficiency: PER requires no model fine-tuning, no additional SAE training, and no hyperparameter search for intervention strength, offering a computationally efficient alternative to existing methods.

Significance and Claims

The paper positions SAEs as powerful interpretability tools for analyzing generative models but highlights a fundamental limitation: monosemantic or sparse features are not inherently suitable as control knobs for direct steering in diffusion models.

The authors claim that their work reveals a "fundamental gap between concept detection and concept intervention." By decoupling these tasks—using SAEs only to find the concept and standard in-distribution data to replace it—the method achieves cleaner erasure results. The paper concludes that for unlearning in diffusion models, preserving the activation manifold is more critical than the interpretability of the intervention vector, and that "Look But Don't Touch" (detect but do not steer) is a more effective strategy than direct manipulation.