A privacy-oriented single-flow model flow decoupling concept erasure method

Abstract

This invention provides a privacy-preserving single-stream model flow decoupling concept erasure method, relating to the field of artificial intelligence security. The method includes the following steps: acquiring a pre-trained single-stream model, determining the set of concepts to be erased and the set of concepts to be retained; constructing a flow decoupling concept erasure framework, initializing learnable low-rank adaptive parameters, and obtaining a secure optimization subspace; within the secure optimization subspace, iteratively optimizing the learnable low-rank adaptive parameters using a Lagrange-guided adaptive erasure modulation algorithm to obtain optimized learnable low-rank adaptive parameters; combining the optimized learnable low-rank adaptive parameters with the pre-trained single-stream model to obtain the erased single-stream model. This invention can safely, stably, and efficiently achieve target erasure and content retention without compromising the model's generation capabilities, while improving privacy protection and ensuring high-quality image generation performance.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security, and in particular to a privacy-preserving method for decoupling concepts in a single-stream model. Background Technology

[0002] In recent years, text-to-image generation technology has undergone rapid development from the basic U-Net architecture to the diffusion Transformer, and finally evolved into a new paradigm of pure single-stream diffusion Transformer. Models represented by Z-Image achieve excellent generation performance while significantly improving computational efficiency by concatenating text tokens and image tokens into a unified sequence and processing it by a Transformer backbone with shared parameters.

[0003] However, this powerful generative capability also brings serious security risks: the model can easily learn and copy copyrighted content, inappropriate content, and biased information from the training data, urgently requiring effective concept erasure techniques as a safe alignment strategy, enabling the model to selectively forget target concepts while maintaining its ability to generate regular content. Although concept erasure techniques have been well validated in traditional U-Net and two-stream architectures, they encounter fundamental failures when directly transferred to single-stream models: because the pure single-stream diffusion Transformer model (hereinafter referred to as the single-stream model) uses a shared self-attention mechanism to process text and image tokens, directly fine-tuning the shared projection weights to suppress text concepts will inevitably interfere with the generation path of the visual base, leading to continuous generation collapses and catastrophic noise output. Through in-depth analysis, the study found that this failure stems from three major technical bottlenecks: the lack of an explicit cross-attention layer in the single-stream model makes traditional methods that rely on this module unsuitable for direct adaptation; the shared self-attention mechanism leads to a strong coupling relationship between text and visual representations; and the naive strategy based on attention localization lacks robustness to changes in cue words.

[0004] Therefore, there is an urgent need for an innovative method specifically designed for single-stream diffusion Transformer architectures that can accurately balance concept erasure and content retention among highly sensitive latent variables, thereby achieving stable, efficient and robust concept erasure. Summary of the Invention

[0005] The purpose of this invention is to provide a privacy-preserving single-stream model stream decoupling concept erasure method to solve the generation collapse problem caused by the deep coupling of text and image processing in the single-stream model in existing concept erasure techniques. It can safely, stably and efficiently achieve target erasure and content preservation without destroying the model's generation capabilities, while improving privacy protection capabilities and ensuring high-quality image generation performance.

[0006] To achieve the above objectives, this invention provides a privacy-preserving method for decoupling and erasing concepts in a single-stream model, comprising the following steps: Step S1: Obtain a pre-trained single-stream model and determine the set of concepts to be erased and the set of concepts to be retained; Step S2: Construct a flow decoupling concept erasure framework, initialize learnable low-rank adaptive parameters, and obtain a safe optimization subspace; Step S3: Within the security optimization subspace, the learnable low-rank adaptive parameters are iteratively optimized using the Lagrange-guided adaptive erasure modulation algorithm to obtain the optimized learnable low-rank adaptive parameters. Step S4: Combine the optimized learnable low-rank adaptive parameters with the pre-trained single-stream model to obtain the erased single-stream model.

[0007] Preferably, in step S1, the pre-trained single-stream model includes text hidden states. and image hidden state Based on the single-stream attention mechanism, the two are concatenated into a unified sequence to obtain the input hidden state. It is processed through a self-attention mechanism with shared weights, specifically expressed as: ; in, This is a concatenation operation along the sequence dimension. For a matrix with dimension in the real number field The matrix space, For the number of image tokens, For the number of text tokens, To hide the feature dimension.

[0008] Preferably, in step S2, constructing the flow decoupling concept erasure framework specifically includes: Define an operator that selects by token, and assign the image token a value of zero and the text token a value of 1 using this operator. The specific expression is as follows: ; Where diag is the main diagonal matrix. It is a zero vector, the number of which is equal to the number of image tokens. , It is an identity matrix whose order is equal to the number of text tokens. , For a matrix with dimension in the real number field The matrix space, Operators selected by token; The initialized learnable low-rank adaptive parameters are LoRA weights, used for text hidden state updates in the linear projection layer of a single-stream model: For The updated hidden state The specific expression is: ; in, This is the original weight matrix of the linear projection layer of the single-flow model. For the initial learnable low-rank fitness parameters, The query weight matrix for the linear projection layer. The key weight matrix of the linear projection layer. The value weight matrix of the linear projection layer; By using operators selected by token and updated hidden states, the updates of learnable low-rank adaptive parameters are restricted to the text hidden states, while bypassing the visual flow and freezing the pixel generation backbone network corresponding to the image hidden states.

[0009] Preferably, in step S3, the learnable low-rank adaptive parameters are iteratively optimized using a Lagrange-guided adaptive erasure modulation algorithm, specifically including: Step S301: Construct an erasure objective function based on the set of concepts to be erased, and a retention objective function based on the set of concepts to be retained. This transforms the trade-off between concept erasure and content retention into a dynamic constraint optimization problem with a retention loss tolerance constraint. The specific expression is as follows: ; in, This represents the update direction of the Lagrangian function with respect to the learnable low-rank adaptive parameters. To erase the objective function, To preserve the objective function, To preserve the loss tolerance, To avoid regularization terms for unbounded solutions, These are the parameters for the current single-flow model. To erase the gradient of the objective function with respect to the current model parameters, To preserve the gradient of the objective function with respect to the current model parameters; These are constraints; Step S302: Introduce Lagrange multipliers to transform the dynamically constrained optimization problem into a dual problem, specifically expressed as: ; in, Let Lagrange be the objective function. For the first Lagrange multipliers of the step; Step S303: Update the Lagrangian function with respect to the learnable low-rank adaptive parameters. To minimize this, we derive a closed-form solution for the parameter update direction in the gradient surgery form. The specific expression is: ; ; in, It is the optimal Lagrange multiplier; Step S304: Solve the Lagrange multipliers using a first-order Taylor expansion. Calculate the change in retained loss using gradient descent to replace the theoretical gradient, and update the Lagrange multipliers accordingly. The specific expression is as follows: ; in, The learning rate is updated for the Lagrange multipliers. The learning rate is updated for the single-stream model. For the first Lagrange multipliers of the step, For the first The approximate gradient of the step Lagrange multipliers, For the first The retention loss value of the step, For the first The retention loss value of the step; Step S305: Based on the closed-form solution of the parameter update direction and the iteratively updated Lagrange multipliers, construct the overall equilibrium objective function. The specific expression is: ; Step S306: Based on the overall equilibrium objective function, update the learnable low-rank adaptive parameters in the safe optimization subspace using gradient descent. The specific expression is as follows: ; in, For the first The updated learnable low-rank adaptive parameters are as follows. For the first The learnable low-rank adaptive parameters of the steps The gradient of the overall equilibrium objective function with respect to the learnable low-rank adaptive parameters; Step S307: Repeat steps S301 to S306 for iterative optimization until the model converges to the Pareto steady-state point, obtaining the optimized learnable low-rank adaptive parameters. ,in, The total number of training steps is preset.

[0010] Preferably, in step S301, the erase target function is... From the first loss Second loss The structure consists of two parts: the first loss is implemented through a negative guidance mechanism in stream matching, and the second loss is based on a single-stream attention mechanism, which is achieved by suppressing the self-attention weights corresponding to the target concept token in the self-attention graph. The specific expression is as follows: ; ; ; in, For expectation operator, The square of the L2 norm, For the first The latent variable state of the step, To erase the concept dataset Sampling a concept to be erased , For the erased model in the concept to be erased Under the conditions Predicting the speed of a step. For pre-trained single-stream models in the concept to be erased Under the conditions Predicting the speed of a step. For pre-trained single-stream models in unconditional Next Predicting the speed of a step. This is a negative guidance intensity hyperparameter. Here is the self-attention weight matrix. The starting index of the target concept token in the sequence. The end index of the target concept token in the sequence. This is the index variable of the self-attention weight matrix.

[0011] Preferably, when calculating the second loss, the word order corresponding to the target concept is randomly shuffled during training to avoid overfitting to fixed word positions.

[0012] Preferably, the objective function is retained. The specific expression is: ; in, For the erased model in unconditional Next Predicting the speed of a step. To preserve the concept dataset Sampling a concept to be retained , For the erased model in the concept to be retained Under the conditions Predicting the speed of a step. For pre-trained single-stream models, in terms of the concepts to be retained Under the conditions Predicting the speed of the step.

[0013] Preferably, in step S307, the model converges to the Pareto steady-state point when: at the Pareto steady-state point, if the generation effect of the concept to be retained is sacrificed, the erasure effect of the concept to be erased cannot be further improved, and the degradation degree of the generation utility of the concept to be retained satisfies: ; in, To preserve the loss value for the pre-trained single-stream model, These are the original parameters of the pre-trained single-stream model. This is a progressive stage.

[0014] Preferably, in step S4, the optimized learnable low-rank adaptive parameters are combined with the pre-trained single-stream model, specifically including: The optimized, learnable low-rank adaptive parameters are applied to the text hidden state path of the pre-trained single-stream model through operators selected by token. The parameters of the pixel generation backbone network corresponding to the image hidden state remain in their original pre-trained state, resulting in the erased single-stream model. The specific expression is as follows: ; in, These are the final parameters of the single-flow model after erasure.

[0015] Therefore, the present invention employs the above-mentioned privacy-preserving single-stream model flow decoupling concept erasure method, and the beneficial technical effects are as follows: (1) This invention achieves effective concept erasure on a single-flow model for the first time. By proposing a flow-decoupled concept erasure framework, it successfully overcomes the generation collapse problem that inevitably occurs when existing methods are directly transferred to a single-flow model. Its stable generation capability has been verified on cutting-edge models such as Z-Image, filling the research gap of this emerging architecture in the field of concept erasure.

[0016] (2) This invention constructs a safe optimization subspace through a flow decoupling concept erasure framework. Only learnable low-rank adaptive parameters are injected into the text hidden state while the visual backbone network is frozen, so that existing concept erasure methods such as AC, UCE, and EraseAnything can play a role again in the single-flow model, realizing the technical transfer and compatibility of traditional methods.

[0017] (3) This invention transforms the trade-off between erasure and retention into a constrained optimization problem by using a Lagrange-guided adaptive erasure modulation algorithm. It adopts dynamic Lagrange multipliers to adjust the erasure intensity in real time, successfully breaking through the limitations of static weighting in multi-conflict objective optimization. It maximizes the erasure effect while ensuring image quality, and achieves a balance in the Pareto optimal sense. Attached Figure Description

[0018] Figure 1 This is a flowchart of a privacy-preserving single-stream model flow decoupling concept erasure method according to the present invention; Figure 2 A comparison of experimental results for a single-concept erasure task. Detailed Implementation

[0019] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0020] Unless otherwise defined, the technical or scientific terms used in this invention shall have the ordinary meaning as understood by one of ordinary skill in the art to which this invention pertains.

[0021] Example 1 like Figure 1 As shown, a privacy-preserving single-stream model flow decoupling concept erasure method includes the following steps: Step S1: Obtain the pre-trained single-stream model and determine the concept set to be erased and the concept set to be retained.

[0022] The pre-trained single-stream model includes text hidden states. and image hidden state Based on the single-stream attention mechanism, the two are concatenated into a unified sequence to obtain the input hidden state. It is processed through a self-attention mechanism with shared weights, specifically expressed as: ; in, This is a concatenation operation along the sequence dimension. For a matrix with dimension in the real number field The matrix space, For the number of image tokens, For the number of text tokens, To hide the feature dimension.

[0023] Unlike the two-stream architecture that uses separate projection matrices for vision and language, the single-stream model shares a single set of independent weight matrices for both modalities. , , Query matrix Key matrix Sum matrix The calculation method is as follows: ; ; ; in, For the query submatrix of image modalities, For the query submatrix of the text modality, The key matrix of the image modality. The key matrix for the text modality. The value submatrix of the image modality, For the value submatrix of the text modality, The query weight matrix for the linear projection layer. The key weight matrix of the linear projection layer. is the value weight matrix of the linear projection layer.

[0024] Self-attention weight matrix Thus generating a The block matrix is ​​used to represent the interactions within and between modes, and its specific expression is: ; in, For activation function, Key matrix Feature dimensions, This is a transpose.

[0025] Step S2: Construct a flow decoupling concept erasure framework, initialize learnable low-rank adaptive parameters, and obtain a safe optimization subspace, specifically including: Define an operator that selects by token, and assign the image token a value of zero and the text token a value of 1 using this operator. The specific expression is as follows: ; Where diag is the main diagonal matrix. It is a zero vector, the number of which is equal to the number of image tokens. , It is an identity matrix whose order is equal to the number of text tokens. , For a matrix with dimension in the real number field The matrix space, Operators selected based on token.

[0026] The initialized learnable low-rank adaptation parameters are LoRA (Low rank adaptation) weights, used for updating the text hidden state of the linear projection layer in a single-stream model: For The updated hidden state The specific expression is: ; in, This is the original weight matrix of the linear projection layer of the single-flow model. For the initial learnable low-rank fitness parameters, The query weight matrix for the linear projection layer. The key weight matrix of the linear projection layer. is the value weight matrix of the linear projection layer.

[0027] By hiding the input state Decomposing it into visual and textual components produces a clear separation in adaptive dynamics: ; in, For the output hidden state of the image modality, For the output hidden state of the text modality, It is a zero matrix. To freeze the weight, These are trainable weights.

[0028] By using operators selected by token and updated hidden states, the updates of learnable low-rank adaptive parameters are restricted to the text hidden states, while bypassing the visual flow. The pixel generation backbone network corresponding to the image hidden states is frozen. This design constructs a safe optimization subspace where text semantics can be adjusted to erase the target concept, visual generation capabilities are fully preserved without interference, and the coupling of shared projection weights is effectively decoupled. This allows previous concept erasure methods to run stably on single-stream models, avoiding the generation collapse problem caused by deep coupling between text and image processing in single-stream models. Subsequent erasure and preservation objective functions are optimized within this safe optimization subspace, ensuring that the concept erasure process does not disrupt the model's visual generation backbone.

[0029] Step S3: Within the security optimization subspace, the learnable low-rank adaptive parameters are iteratively optimized using a Lagrange-guided adaptive erasure modulation algorithm to obtain the optimized learnable low-rank adaptive parameters. Specifically, this includes: Step S301: Construct an erasure objective function based on the set of concepts to be erased, and a retention objective function based on the set of concepts to be retained. This transforms the trade-off between concept erasure and content retention into a dynamic constraint optimization problem with a retention loss tolerance constraint. The specific expression is as follows: ; in, This represents the update direction of the Lagrangian function with respect to the learnable low-rank adaptive parameters. To erase the objective function, To preserve the objective function, To preserve the loss tolerance, To avoid regularization terms for unbounded solutions, These are the parameters for the current single-flow model. To erase the gradient of the objective function with respect to the current model parameters, To preserve the gradient of the objective function with respect to the current model parameters; These are constraints.

[0030] Among them, the erasure objective function From the first loss Second loss The structure consists of two parts: the first loss is implemented through a negative guidance mechanism in stream matching, and the second loss is based on a single-stream attention mechanism, which is achieved by suppressing the self-attention weights corresponding to the target concept token in the self-attention graph. The specific expression is as follows: ; ; ; in, For expectation operator, The square of the L2 norm, For the first The latent variable state of the step, To erase the concept dataset Sampling a concept to be erased , For the erased model in the concept to be erased Under the conditions Predicting the speed of a step. For pre-trained single-stream models in the concept to be erased Under the conditions Predicting the speed of a step. For pre-trained single-stream models in unconditional Next Predicting the speed of a step. This is a negative guidance intensity hyperparameter. Here is the self-attention weight matrix. The starting index of the target concept token in the sequence. The end index of the target concept token in the sequence. This is the index variable of the self-attention weight matrix.

[0031] Preserve the objective function The specific expression is: ; in, For the erased model in unconditional Next Predicting the speed of a step. To preserve the concept dataset Sampling a concept to be retained , For the erased model in the concept to be retained Under the conditions Predicting the speed of a step. For pre-trained single-stream models, in terms of the concepts to be retained Under the conditions Predicting the speed of the step.

[0032] Step S302: Introduce Lagrange multipliers The dynamic constraint optimization problem is transformed into a dual problem, specifically expressed as: ; in, Let Lagrange be the objective function. For the first The Lagrange multiplier of the step.

[0033] Step S303: Update the Lagrangian function with respect to the learnable low-rank adaptive parameters. To minimize this, we derive a closed-form solution for the parameter update direction in the gradient surgery form. The specific expression is: ; ; in, It is the optimal Lagrange multiplier.

[0034] Step S304: Solve the Lagrange multipliers using a first-order Taylor expansion. Calculate the change in retained loss using gradient descent to replace the theoretical gradient, and update the Lagrange multipliers accordingly.

[0035] Directly calculating the theoretical gradient of Lagrange multipliers requires solving separately. and Performing a dot product operation requires two independent backpropagations, which is computationally expensive. To address this issue, this embodiment uses a first-order Taylor expansion for approximate solution. The gradient dot product is approximated as the change in the retained loss value, specifically expressed as: ; in, The theoretical gradient of the Lagrange multipliers, For the first The retention loss value of the step, For the first The retained loss value of the step.

[0036] The above equation transforms expensive geometric projections into inexpensive scalar observations, requiring only one forward propagation to obtain the preserved loss value, without the need for additional backpropagation. Therefore, based on the above equation, the specific expression for the actual update rule of the Lagrange multipliers is: ; in, The learning rate is updated for the Lagrange multipliers. The learning rate is updated for the single-stream model. For the first Lagrange multipliers of the step, For the first The approximate gradient of the step Lagrange multipliers, For the first The retention loss value of the step, For the first The retained loss value of the step.

[0037] This update rule forms a self-regulating loop: if the model violates the preservation constraint (i.e., ... Significantly increased, making The Lagrange multipliers increase, forcing the model to prioritize preservation in the next unified backpropagation step; otherwise, the Lagrange multipliers decrease, allowing for aggressive concept erasure. Through this adaptive adjustment mechanism, this embodiment can automatically find the optimal balance between erasure and preservation without manually setting fixed weights.

[0038] Step S305: Based on the closed-form solution of the parameter update direction and the iteratively updated Lagrange multipliers, construct the overall equilibrium objective function. The specific expression is: ; Step S306: Based on the overall equilibrium objective function, update the learnable low-rank adaptive parameters in the safe optimization subspace using gradient descent. The specific expression is as follows: ; in, For the first The updated learnable low-rank adaptive parameters are as follows. For the first The learnable low-rank adaptive parameters of the steps This represents the gradient of the overall equilibrium objective function with respect to the learnable low-rank adaptive parameters.

[0039] Step S307: Repeat steps S301 to S306 for iterative optimization until the model converges to the Pareto steady-state point, obtaining the optimized learnable low-rank adaptive parameters. .in, This is the preset total number of training steps. In this example, it is set to 1000 steps.

[0040] The model converges to the Pareto steady-state point when: at the Pareto steady-state point, if the generation effect of the concepts to be retained is sacrificed, the erasure effect of the concepts to be erased cannot be further improved, and the degradation degree of the generation utility of the concepts to be retained satisfies: ; in, To preserve the loss value for the pre-trained single-stream model, These are the original parameters of the pre-trained single-stream model. This is a progressive stage.

[0041] Step S4: Combine the optimized learnable low-rank adaptive parameters with the pre-trained single-stream model to obtain the erased single-stream model. Specifically, this includes: The optimized, learnable low-rank adaptive parameters are applied to the text hidden state path of the pre-trained single-stream model through operators selected by token. The parameters of the pixel generation backbone network corresponding to the image hidden state remain in their original pre-trained state, resulting in the erased single-stream model. The specific expression is as follows: ; in, These are the final parameters of the single-flow model after erasure.

[0042] To further verify the actual performance of the method of the present invention on a single-flow model, specific experiments will be conducted below.

[0043] In the NSFW content removal performance evaluation, based on 4,703 cue words from the I2P dataset, the model's ability to remove sensitive content, specifically nudity and violence, was examined. Nudity detection used a NudeNet classifier with a threshold of 0.6, while violence was evaluated using a Q16 classifier. To measure the preservation ability of the proposed method on general content, 10,000 titles were randomly selected from the MS-COCO dataset, images were generated, and FID and CLIP scores were calculated to evaluate the degree of preservation of image quality and semantic consistency. Experimental results are shown in Table 1.

[0044] Table 1 Evaluation of NSFW Removal Effectiveness

[0045] Experimental results show that the method of this invention performs excellently in naked content detection, with a total of only 161 detected cases, significantly lower than Z-Image Turbo's 649 cases, second only to the UCE method. However, unlike UCE, which causes a severe drop in image quality during the erasure process (FID rises to 38.38, CLIP drops to 21.66), the method of this invention maintains superior image generation quality while achieving efficient erasure, with an FID of 26.46 and a CLIP score of 31.25, almost on par with Z-Image Turbo. In terms of brute-force content erasure, the method of this invention performs best, with a total of only 324 detected cases, far lower than other comparative methods, and both FID and CLIP indicators remain leading. In summary, the method of this invention achieves efficient NSFW content erasure while maximizing the ability to generate regular content, demonstrating a good balance between security and practicality.

[0046] In the evaluation of celebrity identity erasure effectiveness, 100 celebrity identities that could be stably generated by Z-Image Turbo were selected from the CelebA dataset and evenly divided into an erasure group and a retention group of 50 identities each. The evaluation used CLIP-based classification accuracy to measure the success rate of generating the erased identities. (Erasing effectiveness, the lower the value the better) and the ability to retain unaffected identity ( (Specificity, the higher the value, the better), and through comprehensive indicators ( (Higher values ​​are better) to evaluate the balance between erasure and preservation. Simultaneously, the MS-COCO 10K dataset was used to calculate FID and CLIP scores to assess the preservation of image quality and semantic consistency. Experimental results are shown in Table 2.

[0047] Table 2 Evaluation of the Effectiveness of Celebrity Identity Erasure

[0048] Experimental results show that the method of the present invention exhibits the best overall balance, with a Ha value of 4.82, significantly outperforming all comparative methods, including MACE (4.46) and UCE (3.79). Regarding erasing efficiency, the method of the present invention... The value was 23.52%, slightly higher than UCE's 21.91%, but UCE showed a serious degradation in retention capacity. Only 25.70%, leading to its The values ​​are significantly lower than those of the method in this invention. More importantly, UCE exhibits a sharp decline in image quality, with an FID as high as 52.28 and a CLIP score dropping to 23.70, almost losing its practical value. In contrast, the method in this invention achieves efficient erasure while maintaining excellent image generation quality (FID of 27.83 and CLIP of 30.06), closely approaching the performance of Z-ImageTurbo and significantly outperforming other mainstream methods. These results fully demonstrate the potential of the method in this invention to support privacy-aware content regulation, effectively eliminating sensitive identity information while maximizing the preservation of the model's general generation capabilities.

[0049] In the evaluation of erasure effectiveness across specific categories, the method's generalization ability across broader conceptual types was further examined. Three main categories were selected: concrete entities (e.g., churches), artistic styles (e.g., Claude Monet), and abstract concepts (e.g., color), each containing 10 specific concepts. The evaluation metrics remained the same. and To comprehensively measure the erasure capability and retention effect of the method on different concept types, the experimental results are shown in Table 3.

[0050] Table 3 Evaluation of erasure effectiveness for specific categories

[0051] Experimental results show that the method of this invention exhibits stable and superior performance across various concepts. In entity class concept erasure, the method of this invention demonstrates… The value is 23.1%, slightly higher than DiT Localization's 17.5%, but the latter performs poorly in terms of retention. The value is only -1.02, indicating that it severely impairs the generation quality of irrelevant concepts during the erasure process. In contrast, the method of this invention achieves a score of 7.4 on entity classes. Its value is second only to DiT Localization but significantly better than all other methods. In more challenging art-style erasure tasks, the method of this invention performs particularly well. It dropped to 26.1%, while With a value of 0.8, it became the only method to achieve a positive balance score in this category, indicating that it can effectively erase the target style while having almost no impact on the generation of other irrelevant styles. Other comparative methods, such as the AC and ESD series, also achieved similar scores in this category. The values ​​are all negative, reflecting the common problems of over-erasing or under-erasing during style erasure. The method of this invention also performs excellently in the erasure of abstract concepts. It was 24.3%. With a value as high as 4.7, significantly outperforming methods such as MACE (3.4) and EraseAnything (3.4), this fully demonstrates the robustness and effectiveness of the method of this invention in handling abstract concepts that are difficult to define precisely. In summary, the method of this invention achieves the optimal balance between erasure efficiency and content preservation across the three major categories of entities, artistic styles, and abstract concepts, showcasing its broad applicability in diverse concept erasure tasks.

[0052] To intuitively verify the performance of the method of the present invention in a single-concept erasure task, a design was created. Figure 2 The comparative experiment shown illustrates this. Using the generated results of Z-Image Turbo as the quality benchmark, the experiment selected concrete and abstract concepts as erasure targets, and visually compared the method of this invention with existing methods such as UCE and EraseAnything. The comparison results are as follows: Figure 2 As shown, Z-Image Turbo generates high-quality images but contains the target concept; UCE can erase the concept but causes severe image distortion and introduces obvious artifacts; EraseAnything suffers from incomplete erasure or semantic bias. In contrast, the method of this invention effectively removes the target concept while maintaining image quality close to that of Z-Image Turbo, with minimal side effects. This comparison result corroborates the quantitative indicators in Table 3, confirming the superiority of the method of this invention in single-concept erasure tasks.

[0053] In the robustness evaluation under adversarial cue attacks, three mainstream adversarial attack methods—Ring-A-Bell, UnlearnDiffAtk, and ReFlux—were used to stress test the erasure effect on naked concepts. Attack success rate (lower values ​​are better) was used as the core evaluation metric to measure the defense capabilities of different erasure methods against well-designed adversarial cues. Specifically, the vulnerable attention zeroing technique (Token Zeroing) was used as a baseline to verify its limitations in practical applications. The experimental results are shown in Table 4.

[0054] Table 4. Adversarial Attack Assessment

[0055] Experimental results show that the method of this invention exhibits the strongest robustness in most attack scenarios. When no attack is performed (only erasure), the attack success rate of the method of this invention is only 10.52%, significantly better than EraseAnything (14.38%) and DiT positioning (57.89%), and far lower than Z-Image Turbo's 83.15%. In the more challenging Ring-A-Bell, the method of this invention still maintains an attack success rate of 24.91%, comparable to the best EraseAnything (26.67%), and significantly outperforming other methods. It is worth noting that Token Zeroing completely fails with slight perturbations to the cue words, with the attack success rate soaring to 82.81% in Ring-A-Bell and significantly higher in ReFlux. The success rate under attack reached as high as 92.85%, fully demonstrating the vulnerability of erasure strategies that rely solely on attention-based localization in practical applications. In contrast, the method of this invention remained stable across all step settings of the ReFlux attack, with the success rate consistently kept below 25.61%, showcasing a robust defense against complex adversarial attacks. These results fully verify that the method of this invention, by fine-tuning the model itself rather than relying on specific marker localization, can fundamentally enhance the robustness of the erasure effect, providing a reliable guarantee for single-stream models to resist malicious attacks in practical deployments.

[0056] Therefore, the present invention adopts the above-mentioned privacy-preserving single-stream model decoupled concept erasure method, which solves the generation collapse problem caused by the deep coupling of text and image processing in the single-stream model in the existing concept erasure technology. It can safely, stably and efficiently achieve target erasure and content preservation without destroying the model's generation capability, and improves privacy protection capability, ensuring the generation performance of high-quality images.

[0057] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A privacy-oriented single-flow model flow decoupling concept erasure method, characterized in that, Includes the following steps: Step S1: Obtain a pre-trained single-stream model and determine the set of concepts to be erased and the set of concepts to be retained; Step S2: Construct a flow decoupling concept erasure framework, initialize learnable low-rank adaptive parameters, and obtain a safe optimization subspace; Step S3: Within the security optimization subspace, the learnable low-rank adaptive parameters are iteratively optimized using the Lagrange-guided adaptive erasure modulation algorithm to obtain the optimized learnable low-rank adaptive parameters. Step S4: Combine the optimized learnable low-rank adaptive parameters with the pre-trained single-stream model to obtain the erased single-stream model.

2. The method for stream decoupling and concept erasure in a privacy-preserving single-stream model according to claim 1, characterized in that, In step S1, the pre-trained single-flow model includes text hidden states and image hidden states , which are spliced into a unified sequence based on a single-flow attention mechanism to obtain input hidden states , and are processed through a self-attention mechanism with shared weights, and the specific expression is: ； wherein, is a concatenation operation on the sequence dimension, is a matrix space of matrix dimension over the real numbers, is the number of image tokens, is the number of text tokens, is the hidden feature dimension.

3. The privacy-preserving single-flow model flow decoupling concept erasure method according to claim 2, characterized in that, In step S2, a flow decoupling concept erasure framework is constructed, specifically including: Define an operator that selects by token, and assign the image token a value of zero and the text token a value of 1 using this operator. The specific expression is as follows: ； wherein diag is a main diagonal matrix, is a zero vector with the number of elements equal to the number of image tokens , is an identity matrix with the order equal to the number of text tokens , is a matrix space over a field of real numbers with the dimension , is an operator selected by a token. The initialized learnable low-rank adaptive parameter is a LoRA weight, which is used for text hidden state updating of the linear projection layer of the single-flow model: for , the specific expression of the updated hidden state is as follows: ； wherein, is the original weight matrix of the single-stream model linear projection layer, is the initialized learnable low-rank adaptation parameter, is the query weight matrix of the linear projection layer, is the key weight matrix of the linear projection layer, is the value weight matrix of the linear projection layer; By using operators selected by token and updated hidden states, the updates of learnable low-rank adaptive parameters are restricted to the text hidden states, while bypassing the visual flow and freezing the pixel generation backbone network corresponding to the image hidden states.

4. The privacy-preserving single-flow model flow decoupling concept erasure method according to claim 3, characterized in that, In step S3, the learnable low-rank adaptive parameters are iteratively optimized using a Lagrange-guided adaptive erasure modulation algorithm, specifically including: Step S301: Construct an erasure objective function based on the set of concepts to be erased, and a retention objective function based on the set of concepts to be retained. This transforms the trade-off between concept erasure and content retention into a dynamic constraint optimization problem with a retention loss tolerance constraint. The specific expression is as follows: ； wherein, is an update direction of the Lagrangian function with respect to the learnable low-rank adaptation parameters, is an erasing objective function, is a preserving objective function, is a preserving loss tolerance, is a regularization term to avoid unbounded solutions, is a current single-flow model parameter, is a gradient of the erasing objective function with respect to the current model parameter, is a gradient of the preserving objective function with respect to the current model parameter; is a constraint condition; Step S302: Introduce Lagrange multipliers to transform the dynamically constrained optimization problem into a dual problem, specifically expressed as: ； in, Let Lagrange be the objective function. For the first Lagrange multipliers of the step; Step S303: Update the Lagrangian function with respect to the learnable low-rank adaptive parameters. To minimize this, we derive a closed-form solution for the parameter update direction in the gradient surgery form. The specific expression is: ； ； in, It is the optimal Lagrange multiplier; Step S304: Solve the Lagrange multipliers using a first-order Taylor expansion. Calculate the change in retained loss using gradient descent to replace the theoretical gradient, and update the Lagrange multipliers accordingly. The specific expression is as follows: ； in, The learning rate is updated for the Lagrange multipliers. The learning rate is updated for the single-stream model. For the first Lagrange multipliers of the step, For the first The approximate gradient of the step Lagrange multipliers, For the first The retention loss value of the step, For the first The retention loss value of the step; Step S305: Based on the closed-form solution of the parameter update direction and the iteratively updated Lagrange multipliers, construct the overall equilibrium objective function. The specific expression is: ； Step S306: Based on the overall equilibrium objective function, update the learnable low-rank adaptive parameters in the safe optimization subspace using gradient descent. The specific expression is as follows: ； in, For the first The updated learnable low-rank adaptive parameters are as follows. For the first The learnable low-rank adaptive parameters of the steps The gradient of the overall equilibrium objective function with respect to the learnable low-rank adaptive parameters; Step S307: Repeat steps S301 to S306 for iterative optimization until the model converges to the Pareto steady-state point, obtaining the optimized learnable low-rank adaptive parameters. ,in, The total number of training steps is preset.

5. The method for stream decoupling and concept erasure in a privacy-preserving single-stream model according to claim 4, characterized in that, In step S301, the target function is erased. From the first loss Second loss The structure consists of two parts: the first loss is implemented through a negative guidance mechanism in stream matching, and the second loss is based on a single-stream attention mechanism, which is achieved by suppressing the self-attention weights corresponding to the target concept token in the self-attention graph. The specific expression is as follows: ； ； ； in, For expectation operator, The square of the L2 norm, For the first The latent variable state of the step, To erase the concept dataset Sampling a concept to be erased , For the erased model in the concept to be erased Under the conditions Predicting the speed of a step. For pre-trained single-stream models in the concept to be erased Under the conditions Predicting the speed of a step. For pre-trained single-stream models in unconditional Next Predicting the speed of a step. This is a negative guidance intensity hyperparameter. Here is the self-attention weight matrix. The starting index of the target concept token in the sequence. The end index of the target concept token in the sequence. This is the index variable of the self-attention weight matrix.

6. The method for stream decoupling and concept erasure in a privacy-preserving single-stream model according to claim 5, characterized in that, When calculating the second loss, the word order corresponding to the target concept is randomly shuffled during training to avoid overfitting to fixed word positions.

7. The method for stream decoupling and concept erasure in a privacy-preserving single-stream model according to claim 6, characterized in that, Preserve the objective function The specific expression is: ； in, For the erased model in unconditional Next Predicting the speed of a step. To preserve the concept dataset Sampling a concept to be retained , For the erased model in the concept to be retained Under the conditions Predicting the speed of a step. For pre-trained single-stream models, in terms of the concepts to be retained Under the conditions Predicting the speed of a step.

8. The method for stream decoupling and concept erasure in a privacy-preserving single-stream model according to claim 4, characterized in that, In step S307, the model converges to the Pareto steady-state point when: at the Pareto steady-state point, if the generation effect of the concept to be retained is sacrificed, the erasure effect of the concept to be erased cannot be further improved, and the degradation degree of the generation utility of the concept to be retained satisfies: ； in, To preserve the loss value for the pre-trained single-stream model, These are the original parameters of the pre-trained single-stream model. This is a progressive stage.

9. A concept erasure method for stream decoupling in a privacy-preserving single-stream model according to claim 8, characterized in that, In step S4, the optimized learnable low-rank adaptive parameters are combined with the pre-trained single-stream model, specifically including: The optimized, learnable low-rank adaptive parameters are applied to the text hidden state path of the pre-trained single-stream model through operators selected by token. The parameters of the pixel generation backbone network corresponding to the image hidden state remain in their original pre-trained state, resulting in the erased single-stream model. The specific expression is as follows: ； in, These are the final parameters of the single-flow model after erasure.

Images