SNCE: Single Neuron Concept Erasure

• The paper demonstrates that SNCE achieves precise concept erasure by identifying and suppressing a target neuron using sparse autoencoder representations.
• It employs contrastive prompt pairs and modulated frequency scoring to isolate harmful features while preserving benign content.
• Experimental results show SNCE significantly reduces unsafe outputs and improves quality metrics compared to coarse-grained erasure methods.

Single Neuron-based Concept Erasure (SNCE) is a concept-erasure method for text-to-image diffusion models that aims to remove harmful concepts by identifying and suppressing a single concept-specific neuron, or a very small top-$k$ set of neurons, in a sparse latent representation learned by a Sparse Autoencoder (SAE) (He et al., 25 Sep 2025). In contrast to coarse-grained methods that edit broad parameter regions, cross-attention layers, or diffusion trajectories, SNCE is designed as a surgical intervention: it maps text embeddings into a sparse, disentangled latent space, locates neurons that activate for a target concept but not for a matched “deconcept” prompt, and suppresses those neurons during generation while preserving the model’s generation capabilities for non-target concepts (He et al., 25 Sep 2025).

1. Problem formulation and methodological position

SNCE is situated within the broader safety problem for text-to-image diffusion models such as Stable Diffusion, which can generate unsafe content including nudity, violence, guns, and knives (He et al., 25 Sep 2025). The paper distinguishes two broad families of safety methods. Content filtering blocks unsafe prompts or outputs using detectors, whereas concept erasure modifies model behavior so that the model cannot generate a target concept. SNCE belongs to the second category.

The method is motivated by limitations of prior concept-erasure approaches. The paper argues that methods such as ESD, UCE, SLD, CA, MACE, SPM, RECE, and DuMo are often coarse-grained: they edit large regions of parameters or broad latent directions, which can remove the target concept but also harm unrelated concepts and degrade image quality (He et al., 25 Sep 2025). SNCE is defined by three design choices: neuron-level intervention instead of broad parameter editing, interpretability through SAEs, and precision via contrastive concept-pair neuron identification.

A common misconception is that concept erasure in diffusion models necessarily requires modifying model weights. SNCE does not operate that way. It intervenes on identified SAE neurons during generation, leaving most of the text embedding and the underlying diffusion model unchanged (He et al., 25 Sep 2025). This suggests a narrower operational notion of concept erasure: suppression of a localized semantic carrier rather than global rewriting of model behavior.

2. Sparse autoencoder representation and semantic disentanglement

SNCE trains an SAE on text encoder activations rather than U-Net features (He et al., 25 Sep 2025). The paper gives three reasons for this choice: it blocks harmful content earlier in the pipeline, it avoids diffusion stochasticity, and text features are lower-dimensional, making training more efficient. Let $h(p) \in \mathbb{R}^d$ denote the text encoder feature vector for prompt $p$. The SAE encoder and decoder are given as

$Z = \mathrm{RELU}\left (W_{\mathrm{enc}(h(p) - b_{\mathrm{pre}) + b_{\mathrm{enc}\right)}$

and

$h' = W_{\mathrm{dec} Z+ b_{\mathrm{pre}$

with intended meanings specified in the paper: $W_{\mathrm{enc}} \in \mathbb{R}^{m \times d}$, $W_{\mathrm{dec}} \in \mathbb{R}^{d \times m}$, $b_{\mathrm{pre}}$ and $b_{\mathrm{enc}}$ are learnable biases, $Z \in \mathbb{R}^m$ is the sparse latent representation, and $h(p) \in \mathbb{R}^d$0 encourages non-negativity and sparsity (He et al., 25 Sep 2025).

The SAE uses a TopK variant in which only the top $h(p) \in \mathbb{R}^d$1 activations are kept and the rest are zeroed out, making sparsity deterministic. Its training objective is

$h(p) \in \mathbb{R}^d$2

where the intended components are the reconstruction loss $h(p) \in \mathbb{R}^d$3, an auxiliary reconstruction error term $h(p) \in \mathbb{R}^d$4, and a weighting coefficient $h(p) \in \mathbb{R}^d$5 (He et al., 25 Sep 2025).

The experimental training configuration is specific: base model Stable Diffusion v1.4, text encoder layer 9th transformer block, SAE hidden dimension 3072, expansion factor 4, TopK 32, learning rate 0.0004, batch size 4096, and training data 30,000 text samples from DiffusionDB and I2P (He et al., 25 Sep 2025). The paper’s interpretability claim is that SAEs decompose dense text representations into sparse, semantically meaningful features, and that some neurons become highly aligned with specific concepts such as “naked,” “violence,” “gun,” or “knife.” The appendix supports this claim by showing discriminative activations for concept prompts versus deconcept prompts.

3. Contrastive concept-pair construction and neuron identification

The central identification mechanism in SNCE is contrastive and concept-specific. For each target concept $h(p) \in \mathbb{R}^d$6, the paper defines a concept vocabulary

$h(p) \in \mathbb{R}^d$7

where each $h(p) \in \mathbb{R}^d$8 is a mention related to the concept (He et al., 25 Sep 2025). A concept pair is written as

$h(p) \in \mathbb{R}^d$9

where $p$0 is a concept prompt containing the target mention and $p$1 is a deconcept prompt with the mention removed. The canonical example is “a photo of a naked woman” versus “a photo of a woman.”

This pairing serves to isolate concept-specific activation from general context. The paper’s stated objective is not merely to find neurons correlated with a prompt, but to identify neurons that activate for the target concept while remaining inactive for the matched deconcept prompt. That distinction is important because it filters out generic correlations such as “woman,” “photo,” or broader “weapon-like” structure (He et al., 25 Sep 2025).

The prompt construction is explicit in the experimental setup: 100 contrastive prompt pairs per concept were generated with Qwen2.5-32B, and the studied concepts were nudity, violence, gun, and knife (He et al., 25 Sep 2025). A plausible implication is that SNCE’s precision depends not only on the SAE representation but also on the quality of the contrastive prompt design, since the concept/deconcept split defines what counts as concept-specific activation.

4. Modulated frequency scoring and the single-neuron hypothesis

SNCE’s neuron-ranking novelty is the modulated frequency scoring of activation patterns (He et al., 25 Sep 2025). For each prompt, SAE activations are extracted and $p$2-normalized, yielding $p$3. The frequency of neuron $p$4 is defined as

$p$5

where $p$6 is the total token positions and $p$7 is the indicator function. The weighted score is then

$p$8

The paper computes this separately for concept prompts and deconcept prompts, producing $p$9 and $Z = \mathrm{RELU}\left (W_{\mathrm{enc}(h(p) - b_{\mathrm{pre}) + b_{\mathrm{enc}\right)}$0.

A neuron is deemed concept-specific if it satisfies

$Z = \mathrm{RELU}\left (W_{\mathrm{enc}(h(p) - b_{\mathrm{pre}) + b_{\mathrm{enc}\right)}$1

and the final intervention set is

$Z = \mathrm{RELU}\left (W_{\mathrm{enc}(h(p) - b_{\mathrm{pre}) + b_{\mathrm{enc}\right)}$2

This procedure emphasizes neurons that are both frequently activated and strongly activated for the concept, while excluding neurons that remain active after the concept term is removed (He et al., 25 Sep 2025).

The paper’s main interpretability claim is that top-ranked neurons in this scoring scheme correspond to atomic semantic concepts. It further reports that top-1 neuron manipulation can already erase the target concept effectively, and presents this as support for the claim that a single neuron may control the harmful concept (He et al., 25 Sep 2025). That claim should be read in the context of the reported limitations: the method’s success may vary if the target concept is more distributed or less localized. Accordingly, the single-neuron hypothesis is an empirical property of the studied setting rather than a universal guarantee.

5. Inference-time suppression and preservation of benign generation

Once the target neurons $Z = \mathrm{RELU}\left (W_{\mathrm{enc}(h(p) - b_{\mathrm{pre}) + b_{\mathrm{enc}\right)}$3 are identified, SNCE suppresses them during generation. For an input prompt $Z = \mathrm{RELU}\left (W_{\mathrm{enc}(h(p) - b_{\mathrm{pre}) + b_{\mathrm{enc}\right)}$4, the text embedding $Z = \mathrm{RELU}\left (W_{\mathrm{enc}(h(p) - b_{\mathrm{pre}) + b_{\mathrm{enc}\right)}$5 is computed, the SAE activations $Z = \mathrm{RELU}\left (W_{\mathrm{enc}(h(p) - b_{\mathrm{pre}) + b_{\mathrm{enc}\right)}$6 are obtained, and a manipulation mask is defined as

$Z = \mathrm{RELU}\left (W_{\mathrm{enc}(h(p) - b_{\mathrm{pre}) + b_{\mathrm{enc}\right)}$7

The manipulated feature is then

$Z = \mathrm{RELU}\left (W_{\mathrm{enc}(h(p) - b_{\mathrm{pre}) + b_{\mathrm{enc}\right)}$8

The intended meaning is that only the contribution of the identified harmful neuron(s) is subtracted back through the decoder, while the rest of the text feature is preserved (He et al., 25 Sep 2025).

The paper refers to this as surgical erasure. The rationale is that the intervention is narrow and targeted, unrelated semantic features are preserved, the model is not globally fine-tuned or heavily edited, and non-target generation remains stable (He et al., 25 Sep 2025). This operational distinction is central to SNCE’s identity: it is not weight pruning, not broad weight rewriting, and not a global latent-direction edit.

The manipulation settings studied are top-1 neuron, top-10 neurons, and top-20 neurons. The paper also reports a monotonic dependence on the manipulation coefficient $Z = \mathrm{RELU}\left (W_{\mathrm{enc}(h(p) - b_{\mathrm{pre}) + b_{\mathrm{enc}\right)}$9 in nudity ASR: 0.6 $h' = W_{\mathrm{dec} Z+ b_{\mathrm{pre}$0 4.29%, 0.7 $h' = W_{\mathrm{dec} Z+ b_{\mathrm{pre}$1 3.43%, 0.8 $h' = W_{\mathrm{dec} Z+ b_{\mathrm{pre}$2 1.82%, 1.0 $h' = W_{\mathrm{dec} Z+ b_{\mathrm{pre}$3 1.50%, and 1.2 $h' = W_{\mathrm{dec} Z+ b_{\mathrm{pre}$4 1.28% (He et al., 25 Sep 2025). The accompanying interpretation is that stronger suppression increases erasure, while the broader qualitative discussion indicates that manipulating more neurons can introduce more collateral impact.

6. Empirical performance, robustness, and relation to subsequent SAE-based erasure

The empirical evaluation covers both safety and utility. Safety metrics are NudeNet detection count for nudity, with threshold 0.6 in the main nudity evaluation, and Q16 violence detection, reported as Attack Success Rate (ASR). Quality preservation is evaluated with CLIP Score (CS) and FID, where lower FID is better (He et al., 25 Sep 2025). The datasets and benchmarks are I2P, MS COCO-30K, and the adversarial benchmarks P4D and Ring-A-Bell.

The main reported results are summarized below.

Evaluation	SNCE result	Context
I2P nudity, top-1	25	Total detected nudity
I2P nudity, top-10	23	Total detected nudity
I2P nudity, top-20	17	Total detected nudity
Top-1 quality	FID 15.85, CS 30.97	Best FID for top-1
Violence erasure	17.7% ASR	SD1.4 baseline 40.1%
P4D adversarial nudity	42.6% ASR	UCE 80.2%, SLD 77.5%, RECE 64.7%, ESD 63.3%
Ring-A-Bell adversarial nudity	6.32% ASR	Lower than all baselines

On I2P nudity evaluation, SNCE reports the lowest total nudity detection counts among all compared methods; the paper states that it outperforms RECE and SPM by more than 50% improvement in detection counts (He et al., 25 Sep 2025). For violence prompts, SNCE achieves 17.7% ASR relative to 40.1% for baseline SD1.4, reported as a 57.3% ASR reduction. The paper also reports that SNCE has the lowest or near-lowest sensitive-area counts across female and male sensitive areas, with especially strong performance on the most important categories.

Robustness is a major part of the paper’s empirical case. On adversarial red-teaming benchmarks, SNCE reports 42.6% ASR on P4D and 6.32% ASR on Ring-A-Bell, both substantially lower than listed baselines for nudity (He et al., 25 Sep 2025). This is presented as evidence that concept-specific neuron suppression is more resistant to adversarial prompt engineering than coarse-grained erasure methods.

A relevant subsequent development is SAEmnesia, which can be viewed as a supervised SAE-based variant of SAeUron/SNCE-style concept erasure for diffusion models (Cassano et al., 23 Sep 2025). SAEmnesia keeps the same general idea of locating concepts in sparse latent features and erasing them by editing a small number of SAE latents at inference time, but it promotes one-to-one concept-neuron mappings through systematic concept labeling. The paper explicitly states that it “promotes one-to-one concept-neuron mappings,” “mitigating feature splitting and promoting feature centralization,” and that “SAEmnesia only needs a single latent to erase each concept” (Cassano et al., 23 Sep 2025). This suggests that SNCE’s single-neuron premise has become a broader design target in SAE-based diffusion-model safety research, even when implemented through different latent spaces and supervision regimes.

7. Scope, limitations, and interpretive significance

SNCE is evaluated on a fixed base model, Stable Diffusion v1.4, and on a limited concept set consisting of nudity, violence, gun, and knife (He et al., 25 Sep 2025). The paper also states that the method still depends on finding good contrastive prompts and concept pairs, and that success may vary if the target concept is more distributed or less localized. These are not incidental caveats: they delimit the conditions under which the reported single-neuron specificity should be expected.

Another potential misconception is that SNCE proves harmful concepts are always stored in one literal model neuron. The method’s intervention space is the SAE latent representation derived from text encoder features, and the paper’s own use of top-1, top-10, and top-20 settings indicates that the single-neuron regime is the preferred but not the only operational mode (He et al., 25 Sep 2025). The empirical claim is therefore one of practical localization and manipulability, not a universal ontological claim about concept storage in diffusion models.

Within concept-erasure research, SNCE’s significance lies in its narrowing of the intervention granularity. It frames safety control as the identification of concept-specific sparse features, selected through concept/deconcept contrast and modulated frequency scoring, followed by minimal targeted suppression. The results reported for safety, benign-generation preservation, and adversarial robustness support that framing in the studied setting (He et al., 25 Sep 2025). A plausible implication is that future work on diffusion-model unlearning may increasingly treat sparse latent interpretability not as an auxiliary analysis tool, but as the primary substrate for precision safety interventions.