MANCE: Manifold Aware Concept Erasure

Abstract: Concept erasure aims to remove a target concept from a representation while preserving the other information encoded in it. This is difficult because representations encode many concepts that are often correlated with the erasure target, so removing the target risks damaging them. We propose the Manifold Constraint Hypothesis (MCH): if natural representations concentrate on a structured, lower-dimensional manifold, then interventions should be constrained to that manifold and better preserve other information encoded in the representation during interventions. We instantiate MCH in a new concept erasure method: MANifold aware Concept Erasure (MANCE). MANCE performs iterative updates to the representations using signals from a classifier that predicts a target concept. We estimate the manifold using representations obtained from natural inputs, and then we project the concept removal update to the estimated manifold. We perform extensive evaluation on 119 settings spanning text and vision, including 13 LLMs, three NLP concepts, and 40 CelebA-CLIP attributes. Employing MANCE on top of previous methods shows consistent improved leakage results. We also introduce MANCE+ and MANCE++, which prepend a closed-form erasure algorithm before employing MANCE, achieving better leakage--surgicality tradeoffs relative to matched full-space updates. MANCE++, our best method, achieves state-of-the-art results on nonlinear concept erasure. These results support MCH in the erasure setting: interventions should be constrained to the natural representation manifold.

• The paper introduces MANCE, an iterative method that projects erasure updates onto locally estimated representation-manifold tangent spaces to improve surgicality without requiring labels for preserved concepts.
• MANCE++ achieves near-chance nonlinear target leakage across 119 NLP and vision settings, reaching 0.0 percentage points above chance at a 10-point surgicality budget and outperforming prior methods.
• The paper shows that tangent-space constraints, rather than iteration alone, drive the gains, while noting limitations from probe-based evaluation, sparse or highly curved manifolds, and higher computational cost.

Overview

Concept erasure seeks to remove a target concept (e.g., gender, safety) from a neural representation while preserving the remaining encoded information — a property termed surgicality. The central difficulty is that concepts are entangled through data correlation and superposition, and the "other" concepts one wishes to preserve are typically unlabeled and unknown, precluding a standard constrained-optimization formulation. This paper, by Avitan, Goldberg, and Elazar (2607.03973), proposes the Manifold Constraint Hypothesis (MCH): if natural representations concentrate on a structured, lower-dimensional manifold $\mathcal{M} \subset \mathbb{R}^d$, then interventions constrained to that manifold should erase the target as effectively as unconstrained interventions while better preserving other information. The hypothesis is operationalized in MANifold aware Concept Erasure (MANCE), an iterative gradient-based erasure method that projects each update onto a locally estimated tangent space of the natural-representation manifold.

The MANCE algorithm

MANCE operates over $H$ rounds on representations $\mathbf{X}^{(0)} \in \mathbb{R}^{N \times d}$ with binary target labels. Each round has three steps:

1. Local manifold estimation. For each representation $\mathbf{x}_i$, the method finds its $k$ nearest neighbors among the natural (unedited) representations, mean-centers them into a matrix $\mathbf{S}_i$, and takes the top-$r$ right singular vectors as a tangent-basis estimate of $T_{\mathbf{x}_i}(\mathcal{M})$. The rank $r$ is set once via the TwoNN intrinsic-dimension estimator with a floor of $k_{\min}=8$. Crucially, the neighborhood is always drawn from $H$0 even as the edited point moves, keeping the manifold estimate anchored to natural geometry.
2. Tangent erasure direction. A nonlinear MLP probe $H$1 predicting the target concept is refit every $H$2 rounds; its normalized input gradient is projected onto the tangent basis and reweighted by the local singular spectrum ($H$3 throughout), yielding a direction $H$4 that concentrates step mass on well-supported manifold directions. The update removes the component of $H$5 along this normalized direction.
3. Per-sample local-radius cap. Rather than a global step size, each sample receives a closed-form step size $H$6, where $H$7 is the mean distance to the sample's $H$8 nearest natural neighbors and $H$9. Because $\mathbf{X}^{(0)} \in \mathbb{R}^{N \times d}$0 is expressed in each panel's own representation scale, $\mathbf{X}^{(0)} \in \mathbb{R}^{N \times d}$1 transfers across all 119 settings without per-setting tuning — a notable practical property given that representation dimensions range from 896 to 5376.

Two variants prepend closed-form preprocessing: MANCE⁺ prepends LEACE (removing first-moment linear signal), and MANCE⁺⁺ additionally prepends CovMatch, a rank-2 specialization of $\mathbf{X}^{(0)} \in \mathbb{R}^{N \times d}$2-LEACE that projects out the leading eigenvectors of the class-conditional covariance asymmetry $\mathbf{X}^{(0)} \in \mathbb{R}^{N \times d}$3. Together these remove at most rank 3, negligible relative to $\mathbf{X}^{(0)} \in \mathbb{R}^{N \times d}$4, leaving the residual nonlinear structure for the manifold-constrained loop.

Evaluation protocol

The evaluation spans 119 settings: 39 NLP settings (13 LLM families from Qwen2.5-0.5B to Gemma-3-27B × three concepts: sycophancy, gender, safety) and 80 CelebA-CLIP settings (40 facial attributes × two surgicality regimes defined by the five most- vs. least-correlated control attributes). Erasure quality is measured by target leakage $\mathbf{X}^{(0)} \in \mathbb{R}^{N \times d}$5 (nonlinear MLP probe accuracy above majority-vote floor) and surgicality by control-concept degradation $\mathbf{X}^{(0)} \in \mathbb{R}^{N \times d}$6, evaluated under fixed budgets $\mathbf{X}^{(0)} \in \mathbb{R}^{N \times d}$7pp. A key methodological point is coverage: because iterative methods may exceed a budget on some settings, leakage means are computed only over covered settings, so coverage and leakage must be read jointly. The paper is careful to apply this standard to its own results and to baselines alike.

Results

MANCE improves prior erasers. Applied on top of existing methods' outputs, MANCE drives residual leakage close to chance under matched budgets: at $\mathbf{X}^{(0)} \in \mathbb{R}^{N \times d}$8pp, LEACE falls from 19.1 to 1.5pp, INLP from 15.2 to 1.8pp, and IGBP from 11.5 to 1.6pp, with equal or greater coverage. Obliviator shows no improvement, but this reflects its low coverage (13–19/39): it reaches chance only on the easy settings it covers and violates the budget elsewhere.

MANCE⁺⁺ achieves state-of-the-art nonlinear erasure. On NLP, MANCE⁺⁺ is the only method near chance at every budget ($\mathbf{X}^{(0)} \in \mathbb{R}^{N \times d}$9pp from $\mathbf{x}_i$0 to $\mathbf{x}_i$1pp, reaching chance on up to 35/39 settings), versus Obliviator's $\mathbf{x}_i$2pp. On CelebA, MANCE⁺⁺ combines high coverage with near-floor leakage: in the least-correlated regime it covers 39–40/40 attributes versus 15–29/40 for Obliviator; in the harder most-correlated regime, 19/40 and 34/40 versus 2/40 and 15/40. Obliviator's apparent zero leakage is explicitly flagged as a coverage artifact — averaged only over easy attributes where MANCE⁺⁺ also reaches floor.

Gains concentrate where entanglement is highest. On gender (profession strongly correlated with gender), MANCE⁺⁺ reaches chance on 12/13 models at $\mathbf{x}_i$3pp versus 0/13 for Obliviator. Sycophancy, by contrast, is fully exhausted by closed-form linear preprocessing alone, leaving nothing for the manifold loop to add — an honest scoping of where the method contributes.

The constraint, not the loop, drives the gains. The ablation AmbCE⁺⁺ — identical to MANCE⁺⁺ but taking full-space gradient steps at the same effective magnitude ($\mathbf{x}_i$4, the empirical mean of MANCE⁺⁺'s per-sample steps) — leaves 6–10pp leakage with reduced coverage. Since AmbCE⁺⁺'s mean is itself computed only over easier covered settings, even that figure understates the gap. This directly supports MCH: the benefit comes from the tangent projection rather than the probe-refit loop or preprocessing.

Independent geometric evidence supports the premise itself: sycophancy representations exhibit intrinsic dimension 34–53 against ambient dimensions of 768–5376, with local/global concept-direction angles of 77–83°, consistent with a curved low-dimensional structure where a single global direction fails.

Limitations

The authors are explicit about several constraints. Both metrics are empirical probe-based measurements, not guarantees: surgicality speaks only to the enumerated control concepts, not the full information content of the representation. The local first-order tangent estimate degrades where natural representations are sparse or curvature is high, and MCH's advantage should shrink as intrinsic dimension approaches $\mathbf{x}_i$5. Computationally, MANCE costs roughly eight minutes per panel (~470s on a B200) versus seconds for LEACE, with ~50% of runtime in per-round local SVDs and ~40% in CPU–GPU transfers — both implementation artifacts, though deployment also requires kNN queries against the stored natural representations. Finally, the formal link between tangent-estimation quality and erasure guarantees remains open, as does whether non-local or global manifold estimators would yield further gains.

Conclusion

This paper connects concept erasure to the geometry of natural representations: constraining edits to locally estimated tangent spaces of the representation manifold yields more surgical nonlinear erasure than full-space updates of matched magnitude, consistently across 13 LLMs, three NLP concepts, and 40 visual attributes. MANCE composes with prior erasers, and MANCE⁺⁺ sets the state of the art under fixed surgicality budgets. The broader claim — that representation interventions generally should respect the geometry induced jointly by model and data, including activation steering — is advanced as a hypothesis supported here only within the erasure setting, with better manifold estimators and formal guarantees left as open problems.