Manifold Aware Concept Erasure (MANCE)

• MANCE is a nonlinear concept erasure technique that constrains interventions to the natural low-dimensional manifold, thereby preserving non-target information.
• It employs local manifold estimation using k-nearest neighbors and SVD to compute tangent spaces, ensuring that gradient updates remain geometry-constrained and surgical.
• Empirical evaluations across text and vision tasks demonstrate that MANCE, especially the MANCE++ variant, achieves near-chance target leakage with minimal collateral damage.

Searching arXiv for the named paper and closely related concept-erasure work. I’ll look up MANCE and nearby manifold-aware concept erasure papers on arXiv. Manifold Aware Concept Erasure (MANCE) is a nonlinear concept erasure method that operationalizes the Manifold Constraint Hypothesis (MCH): if natural representations concentrate on a structured, low-dimensional manifold, then interventions should be constrained to that manifold and better preserve other information encoded in the representation during interventions (Avitan et al., 4 Jul 2026). In this formulation, concept erasure is not treated as unconstrained movement in the ambient Euclidean space, but as a locally manifold-constrained update process driven by a classifier for the target concept. MANCE estimates local tangent spaces from natural representations, projects concept-removal updates onto those tangent spaces, and applies a closed-form per-sample step-size cap. The method is evaluated across 119 settings spanning text and vision, and the reported results position MANCE, especially MANCE++, as a state-of-the-art approach to nonlinear concept erasure under leakage--surgicality tradeoffs (Avitan et al., 4 Jul 2026).

1. Conceptual basis and Manifold Constraint Hypothesis

MANCE begins from the observation that learned representations from natural data do not fill out their ambient Euclidean space uniformly, but instead concentrate on a structured, low-dimensional manifold (Avitan et al., 4 Jul 2026). Let $\mathcal{M}\subset\mathbb{R}^d$ be the unknown manifold on which natural representations lie. An intervention

$x\mapsto x+\delta$

is said to be constrained to $\mathcal{M}$ if $x+\delta\in\mathcal{M}$; unconstrained updates allow $\delta$ in any direction in $\mathbb{R}^d$.

MCH states: “Among all interventions that achieve the same effect on the target concept, those constrained to $\mathcal{M}$ will better preserve all other (unlabeled) information encoded in the representation.” This premise defines the core distinction between MANCE and prior full-space nonlinear erasure procedures. In MANCE, the aim is not merely to reduce classifier confidence for the target concept, but to do so while minimizing collateral damage to other information, described in the paper as “surgicality” (Avitan et al., 4 Jul 2026).

A plausible implication is that MANCE reframes concept erasure from a purely discriminative suppression problem into a geometry-constrained intervention problem. In that reading, the relevant object is not only the probe gradient but also the local geometry of the representation support.

2. Nonlinear concept erasure formulation

The method assumes representations $X\in\mathbb{R}^{N\times d}$ and binary labels $y\in\{0,1\}^N$ for the concept to erase (Avitan et al., 4 Jul 2026). A standard gradient-based erasure round fits a probe

$f:\mathbb{R}^d\to\mathbb{R}$

by minimizing a classification loss such as cross-entropy,

$x\mapsto x+\delta$0

The probe may be, for example, “a small MLP.”

After fitting the probe, one computes the gradient of the probe’s score for the positive class with respect to the inputs,

$x\mapsto x+\delta$1

and takes a step

$x\mapsto x+\delta$2

or more generally

$x\mapsto x+\delta$3

to reduce the probe’s confidence. The paper states that unconstrained iterative application of such steps, with probe refits, can erase the concept but often damages other information (Avitan et al., 4 Jul 2026).

MANCE retains the iterative, probe-driven structure of nonlinear erasure, but changes the permissible update directions. Rather than accepting the probe gradient as an update in the full ambient space, it estimates a local tangent space and projects the update there. This suggests that MANCE should be understood as a geometry-constrained generalization of iterative probe-based erasure rather than as a different supervision regime.

3. Local manifold estimation and tangent-space projection

To constrain updates to $x\mapsto x+\delta$4, MANCE estimates the tangent space $x\mapsto x+\delta$5 at each point $x\mapsto x+\delta$6 by sampling its $x\mapsto x+\delta$7 nearest neighbors from the clean representations $x\mapsto x+\delta$8 (Avitan et al., 4 Jul 2026). For each sample,

$x\mapsto x+\delta$9

and

$\mathcal{M}$0

An SVD is then computed:

$\mathcal{M}$1

The top-$\mathcal{M}$2 right singular vectors are retained,

$\mathcal{M}$3

so that $\mathcal{M}$4.

Given the normalized probe gradient

$\mathcal{M}$5

its orthogonal projection onto the estimated tangent space is

$\mathcal{M}$6

The coordinate form used by MANCE is

$\mathcal{M}$7

where $\mathcal{M}$8 and $\mathcal{M}$9 reweights the tangent axes by their local variance support. The reported setting is $x+\delta\in\mathcal{M}$0 in all experiments (Avitan et al., 4 Jul 2026).

The use of local PCA rather than a single global subspace is empirically motivated. For the hardest case, sycophancy, the estimated local intrinsic dimension is 34–53 $x+\delta\in\mathcal{M}$1, and the mean angle between local tangent directions and a single global direction is 77°–83°, confirming that a global linear subspace is a poor approximation (Avitan et al., 4 Jul 2026). This directly addresses a common misconception: MANCE is not a global linear projection method.

4. Update rule, step-size cap, and preprocessing variants

MANCE applies a locality-preserving cap on the step size so that the update norm does not exceed an $x+\delta\in\mathcal{M}$2-fraction of the average neighbor distance (Avitan et al., 4 Jul 2026). For each sample,

$x+\delta\in\mathcal{M}$3

Using the tangent update

$x+\delta\in\mathcal{M}$4

and enforcing $x+\delta\in\mathcal{M}$5, the paper gives the closed-form per-sample step

$x+\delta\in\mathcal{M}$6

The iterative loop initializes $x+\delta\in\mathcal{M}$7 from natural inputs, periodically refits the probe every $x+\delta\in\mathcal{M}$8 steps, recomputes the local neighborhood geometry, forms tangent-projected directions, and updates each $x+\delta\in\mathcal{M}$9 accordingly (Avitan et al., 4 Jul 2026).

The framework also includes two preprocessing variants that prepend closed-form erasure before the manifold-constrained loop:

Variant	Prepending step	Description
MANCE	None	Tangent-projected nonlinear erasure
MANCE$\delta$0	LEACE	One-shot linear erasure removing the class-mean shift
MANCE$\delta$1	LEACE + CovMatch	Affine projections of total rank $\delta$2 before MANCE

MANCE$\delta$3 prepends the one-shot LEACE linear erasure, which removes the class-mean shift in closed form. MANCE$\delta$4 further prepends a rank-2 “CovMatch” projection that aligns class-conditional second moments by removing the top two eigenvectors of $\delta$5. Both steps are affine projections of total rank $\delta$6, after which the residual nonlinear pocket is erased by the MANCE loop (Avitan et al., 4 Jul 2026).

A common misunderstanding is that MANCE’s gains might come only from adding nonlinear iterations after a strong linear preprocessor. The reported ablation “AmbCE$\delta$7” replaces the tangent-projection update by full-space gradient steps of the same mean magnitude $\delta$8. Without the manifold constraint it leaves 6–10 pp leakage and often exceeds the surgicality budget, showing that the key gain comes from the tangent-projection, not merely from the nonlinear probe loop or closed-form preprocessing (Avitan et al., 4 Jul 2026).

5. Evaluation protocol and empirical results

The experimental program spans both language and vision (Avitan et al., 4 Jul 2026). In text, the paper reports 119 panels comprising 13 open-source LLM families (0.5B–27B parameters) $\delta$9 3 binary concepts (sycophancy, gender, safety) evaluated at the 50%-depth layer, with control concepts answer-preference, profession, helpfulness. In vision, it reports 80 panels using CLIP ViT-B/32 pooled embeddings of CelebA images; 40 binary facial attributes are evaluated under two surgicality regimes, defined by the 5 least- versus 5 most-correlated control attributes.

The main metrics are target leakage and surgicality. Target leakage $\mathbb{R}^d$0 is the accuracy of a retrained nonlinear MLP probe (2-layer, $\mathbb{R}^d$1) on the erased representations; $\mathbb{R}^d$2 measures residual concept signal above chance. Surgicality $\mathbb{R}^d$3 is the drop in accuracy on control concepts; the budget $\mathbb{R}^d$4 is capped at 1, 3, 5, 10 pp. Coverage is the number of panels with at least one trajectory step satisfying $\mathbb{R}^d$5 (Avitan et al., 4 Jul 2026).

The reported quantitative findings emphasize matched-budget comparisons. Applying MANCE on top of prior erasers (INLP, IGBP, LEACE, Obliviator) consistently reduces leakage at matched surgicality budgets. On the 39-panel NLP grid under $\mathbb{R}^d$6 pp, LEACE alone has +19.1 pp leakage and +MANCE reduces this to +1.5 pp while covering 38/39 panels; INLP changes from +15.2 to +1.8; IGBP from +11.5 to +1.6; Obliviator had zero leakage but only 13/39 coverage (Avitan et al., 4 Jul 2026).

MANCE$\mathbb{R}^d$7 is reported as the strongest nonlinear eraser. On NLP at $\mathbb{R}^d$8 pp it drives leakage to 0.0 pp and reaches chance on 32/37 panels; at $\mathbb{R}^d$9 pp it stays at 0.0 pp on 35/39. In vision, under least-correlated controls, MANCE$\mathcal{M}$0 covers 35/39 attributes at $\mathcal{M}$1 pp with +0.7 pp leakage, and 40/40 at $\mathcal{M}$2 pp with 0.0 pp. Under most-correlated controls, MANCE$\mathcal{M}$3 still covers 15/19 at $\mathcal{M}$4 pp and 33/38 at $\mathcal{M}$5 pp with +2.5 pp leakage. Obliviator attains near-floor leakage only at far lower coverage on the hardest attributes (Avitan et al., 4 Jul 2026).

These results support the paper’s conclusion that MANCE and its MANCE$\mathcal{M}$6 variant achieve state-of-the-art nonlinear concept erasure: near-chance leakage under tight surgicality budgets and high coverage even on the most entangled controls (Avitan et al., 4 Jul 2026).

6. Position within manifold-aware erasure research

MANCE belongs to a broader 2026 trend toward manifold-aware concept erasure, but its formulation is distinct from other methods using related language. OrthoEraser, for example, addresses text-to-image safety in diffusion models by reframing concept erasure as a manifold-aware projection problem at an intervention layer (Shi et al., 12 Mar 2026). It uses sparse autoencoders to decompose dense activations, detects coupled benign neurons by zero-ablation, and applies an analytical gradient orthogonalization strategy that projects erasure vectors onto the null space of the coupled neurons. The erasure objective is

$\mathcal{M}$7

so that subtracting $\mathcal{M}$8 guarantees $\mathcal{M}$9, i.e. the benign subspace is exactly invariant (Shi et al., 12 Mar 2026).

The contrast is instructive. OrthoEraser preserves a critical benign subspace through an analytical orthogonal projection, whereas MANCE preserves information by estimating local tangent spaces from natural representations and constraining iterative nonlinear updates to those spaces. This suggests two different senses of “manifold-aware”: one based on local manifold estimation in representation space, and one based on subspace-preserving projection after disentanglement (Avitan et al., 4 Jul 2026, Shi et al., 12 Mar 2026).

A further source of terminological ambiguity appears in text-to-image erasure work that uses the phrase “manifold aware concept erasure” in a different construction. TICoE defines a continuous convex concept manifold

$X\in\mathbb{R}^{N\times d}$0

built from prompt-bank embeddings, and combines it with Hierarchical Visual Representation Learning for precise concept removal in diffusion models (Li et al., 17 Apr 2026). In that setting, the “manifold” is a convex semantic hull in text-embedding space rather than an estimated local tangent structure over natural hidden representations.

Taken together, these works indicate that manifold-aware erasure is not a single algorithmic family but a broader design principle: constrain erasure to geometrically structured regions associated with natural or benign variation. In the specific sense established by MANCE, the central claim is narrower and more technical: interventions should be constrained to the natural representation manifold, and local tangent-projected updates provide a practical mechanism for doing so (Avitan et al., 4 Jul 2026).