ConceptVoid: Precision Multi-Concept Erasure in Generative Video Diffusion

Abstract

Generative video diffusion models (GVDs) generate high-fidelity, text-conditioned videos but risk producing unsafe or copyrighted content due to training on large, uncurated datasets. Concept erasure techniques aim to remove such harmful concepts from pre-trained models while preserving overall generative performance. However, existing methods mainly target single-concept erasure and thus cannot satisfy the demand for simultaneously eliminating multi-concept in real-world scenarios. On the one hand, naively applying single-concept erasure sequentially to multi-concept often yields suboptimal results due to conflicts among target concepts; on the other hand, methods that alter concept mappings exhibit very poor adaptability and fail to accommodate the dynamic concept changes. To address these, we propose ConceptVoid, a scalable multi-concept erasure framework formulated as a constrained multi-objective optimization problem. For each target concept, an erasure loss is defined as the discrepancy between noise predictions conditioned and unconditioned on the concept. Non-target generation capabilities are preserved via output-distribution alignment regularization. We apply the multiple gradient descent algorithm (MGDA) to obtain Pareto-optimal solutions, aiming to minimize conflicts among different concept erasure objectives. In addition, we improve MGDA by introducing an importance-weighting mechanism, which adjusts the weights of gradients corresponding to each erasure objective, enabling flexible control over the priority and intensity of erasing different concepts, thereby enhancing the scalability of ConceptVoid. Extensive experiments demonstrate the effectiveness of ConceptVoid, validating our key contributions: (1) a scalable framework for multi-concept erasure in GVDs; (2) the integration of per-concept erasure with distribution alignment to retain non-target quality; and (3) an enhanced MGDA for conflict-aware, controllable erasure.

1. Introduction

Generative video diffusion models (GVDs) [1,2,3] have rapidly emerged in recent years as an industrial-grade solution capable of producing high-fidelity, text-conditioned video clips [4,5]. These models have found wide-ranging applications in fields such as virtual cinematography and interactive simulations. However, since GVDs are typically trained in large-scale video datasets that are not rigorously curated, they inevitably learn and reproduce certain unsafe or harmful content concepts, such as explicit nudity, violent scenes, or recognizable and copyrighted characters [6,7,8,9,10]. As a result, they may generate realistic yet potentially harmful video content [11], posing serious negative implications for society [12,13,14,15]. Consequently, how to effectively prevent GVDs from generating harmful content has become a novel and pressing research challenge.

A common strategy to address this challenge is retraining on a filtered dataset excluding such content. While theoretically feasible, this strategy is often impractical for large-scale models due to its high computational and resource demands [16,17,18,19]. To mitigate this, concept erasure [20,21,22,23] techniques have been developed to remove harmful concepts from pretrained models without retraining, aiming to preserve generative quality and semantic coverage. Concept erasure techniques for GVDs fall into two main categories. The first involves fine-tuning-based methods [20,21] that use negative guidance gradients, often with regularization to preserve non-target content. The second category includes training-free methods that avoid parameter re-optimization. These suppress target concepts via null-space vector subtraction [22] or latent code replacement [23]. Though effective for single-concept erasure, real-world use often demands multi-concept erasure and fine-grained control over erasure strength. Applying existing methods sequentially to multiple concepts introduces two key challenges:

• Challenge I: interference between concepts. Independently designed erasures can conflict, degrade performance, or remove unintended content.
• Challenge II: scalability limitations. Current methods lack adaptability, making it hard to accommodate dynamic concept changes or strategy adjustments.

To address the above challenges, we propose ConceptVoid, a scalable and flexible multi-concept erasure framework for GVDs based on constrained multi-objective optimization. It mitigates conflicts in multi-concept erasure while maintaining broad applicability. To tackle inter-concept conflicts (Challenge I), ConceptVoid reformulates the erasure task as a constrained multi-objective problem. For each harmful concept, it defines an individual erasure loss by computing the difference between noise outputs conditioned and unconditioned on the concept prompt. This difference is subtracted from the unprompted output to guide the erasure. To preserve model capability, we introduce output-distribution alignment regularization to constrain output drift, thereby protecting non-target generation capabilities. We solve the optimization using the multiple gradient descent algorithm (MGDA) to obtain a Pareto-optimal solution, effectively balancing multiple concept objectives and reducing interference. For scalability (Challenge II), we incorporate importance weighting for target concepts during the optimization process. By adjusting the weights associated with each concept’s gradient, the framework enables flexible control over the priority and intensity of concept erasure.

Our main contributions can be summarized as follows:

• We propose ConceptVoid, a framework for multi-concept erasure in GVDs that effectively resolves inter-concept conflict and offers strong scalability.
• By reformulating the erasure task as a constrained multi-objective optimization problem and solving it via MGDA, we achieve a Pareto-optimal solution that minimizes inter-concept interference.
• We enhance MGDA with importance weighting, enabling adaptive control over erasure priorities, further improving scalability in complex scenarios.
• We conduct extensive experiments on state-of-the-art GVDs and multiple real-world datasets. The results demonstrate the effectiveness of the proposed method in multi-concept erasure tasks.

2. Related Works

2.1. Generative Video Diffusion Models

Early GVDs [24,25,26], inspired by generative image diffusion models (GIDs), typically adopt U-Net [27] backbones with cross-attention to integrate textual inputs. For example, VDM [28] employs a 3D U-Net to enhance text-video alignment, while VideoCrafter2 [29] introduces a two-stage training scheme to disentangle motion and appearance at the data level. Despite early success, U-Net-based models struggle with long-range temporal modeling and are computationally inefficient. To overcome these limitations, recent works [2,3] have shifted toward diffusion transformers (DiTs) [30], often omitting traditional cross-attention. For instance, CogVideoX [3] utilizes a multimodal DiT [31] that concatenates text and visual tokens as input to a cross-modal 3D full-attention layer, enhancing both efficiency and performance. HunyuanVideo [2] explores dual- and single-stream DiT variants, processing tokens either separately or jointly within a unified attention module. To evaluate the generalizability of our proposed ConceptVoid framework across different architectures, we conduct empirical studies on both U-Net-based and DiT-based architectures.

2.2. Concept Erasure

Concept erasure for generative models [32,33,34,35] seeks to eliminate specific harmful concepts from pretrained models without retraining, while maintaining generation quality and semantic integrity. Existing studies primarily address this in GIDs, with limited attention to GVDs. As follows, we provide an in-depth analysis of both lines of research.

2.2.1. Concept Erasure for GIDs

Concept erasure in GIDs can be broadly divided into fine-tuning-based and training-free methods, depending on their reliance on gradient updates. Fine-tuning methods, such as Forget-Me-Not [36] and other targeted weight update strategies, use negative samples or counterexamples [37] to suppress specific concepts. While effective, they require retraining for each target and risk catastrophic forgetting. In contrast, training-free methods perform erasure without gradient updates. For instance, UCE [38] modifies the text projection layer via a closed-form solution to enable debiasing and concept erasure. RECE [39] introduces an eraser embedding into the cross-attention mechanism, allowing efficient and thorough concept erasure through rapid closed-form inference. Despite notable success in text-to-image tasks, these methods remain tightly coupled to GID architectures and show limited robustness and precision when extended to GVDs.

2.2.2. Concept Erasure for GVDs

Recent research has begun addressing concept erasure in GVDs, with methods similarly classified into fine-tuning-based and training-free methods. Early work focused on fine-tuning, for example, T2VUnlearning [20] employs negatively-guided velocity prediction with prompt augmentation to suppress target concepts, along with localization and preservation regularization to retain unrelated content. Later methods [21] improve efficiency by restricting updates to the text encoder. More recently, training-free methods have gained attention. Some [22] extract rejection vectors from intermediate activations of concept-differentiated input pairs and subtract them from model weights. Others [23] operate in the discrete latent space, identifying and replacing encodings tied to specific concepts or actions. While these methods offer promising directions, they remain inadequate for multi-concept erasure in practical scenarios. To address this gap, we propose the ConceptVoid, tailored for robust and efficient multi-concept erasure in GVDs.

3. Preliminary

3.1. Traning Process of GVDs

Let $x_0\in {\mathbb{R}}^{M\times H\times W\times C}$ denote a clean target video sequence, where M represents the number of frames, $H\times W$ the resolution, and C the number of channels. Let $y\in \mathcal{Y}$ also denote the textual prompt, L the predefined total number of denoising steps, and ${\left\{{\beta }_t\right\}}_{t=1}^L$ the predefined noise scheduling parameters, where ${\beta }_t\in (0,1)$ indicates the noise intensity injected at step t. GVDs first add noise to the video $x_0$ progressively according to the following Markov chain:

$$q(x_t\mid x_{t-1})=\mathcal{N}(x_t;\sqrt{{\alpha }_t}{x}_{t-1},{\beta }_{t}I),$$

where $x_t$ denotes the noisy video sequence at step t, $\mathcal{N}(\mu ,\Sigma )$ denotes a Gaussian distribution with mean $\mu$ and covariance matrix $\Sigma$, and ${\alpha }_t=1-{\beta }_t$ represents the retention ratio at step t. Let $\epsilon \sim \mathcal{N}(0,I)$ denotes standard Gaussian noise, to improve training efficiency, the multi-step noise addition can be further simplified into a single-step noise injection [40]:

$$q(x_t\mid x_0)=\mathcal{N}(x_t;\sqrt{{\overline{\alpha }}_t}{x}_0,(1-{\overline{\alpha }}_t)I),$$

where $x_t=\sqrt{{\overline{\alpha }}_t}{x}_0+\sqrt{1-{\overline{\alpha }}_t}\epsilon$, and ${\overline{\alpha }}_t={\prod }_{s=1}^t{\alpha }_s$. To enable the model to learn video generation, GVDs employ a neural network parameterized by $\theta$, denoted as ${\epsilon }_{\theta }(x_t,t,y)$, to predict the noise.

3.2. Inference Process of GVDs

The generation inference begins with a noisy video sequence $x_L$ and iteratively denoises it through a sampling method to produce the clean target video sequence $x_0$. Specifically, the sampling methods include standard DDPM [40] sampling, DDIM [41] sampling, and classifier-free guidance (CFG) [42]. Taking DDPM sampling as an example, for $t=1,2,\cdots ,L$, the denoising operation is performed as

$$x_{t-1}={\displaystyle \frac{1}{\sqrt{{\alpha }_t}}}\left(x_t-{\displaystyle \frac{{\beta }_t}{\sqrt{1-{\overline{\alpha }}_t}}}{\epsilon }_{\theta }(x_t,t,y)\right)+{\sigma }_t{z}_t,$$

where $z_t$ denotes the additional injected random noise, and ${\sigma }_t$, which can be either $\sqrt{{\beta }_t}$ or 0 (i.e., deterministic sampling), represents the user-specified noise injection strength.

4. Method

We propose ConceptVoid to tackle multi-concept erasure in real-world settings. We begin by formalizing single-concept erasure as a computable task, then reformulate it as a constrained optimization problem, enabling its extension to a constrained multi-objective framework for multi-concept erasure.

4.1. Single-Concept Erasure

4.1.1. Problem Setup of Concept Erasure

Since existing studies on concept erasure in T2Vs have not yet provided a formal mathematical definition of the problem, we draw upon the definitions established in text and image generation models [43,44,45,46] and adapt them for the T2Vs setting.

Suppose the target concept to be erased is c. Let ${\mathcal{Y}}_c\subset \mathcal{Y}$ represent the set of textual prompts that describe or contain concept c, and let ${\tilde{\mathcal{Y}}}_c$ denote the set of safe prompts (i.e., those that do not contain c). Let the original model parameters be denoted as $\widehat{\theta }$, with the corresponding conditional generative distribution also denoted as $p_{\widehat{\theta }}(·|x_t,y)$. After erasure, the updated model parameters are denoted as ${\theta }^{*}$, with the corresponding generative distribution $p_{{\theta }^{*}}(·|x_t,y)$. Let $q_{\mathrm{safe}}(·)$ be the safe distribution, which can be a prior distribution unrelated to c or a masked generative distribution, serving as a reference for complete erasure. The goal of concept erasure is to identify a new set of parameters ${\theta }^{*}$ without retraining, such that the following conditions are satisfied:

• I: high erasure strength. For prompts in ${\mathcal{Y}}_c$, the generative distribution should be as close as possible to $q_{\mathrm{safe}}(·)$, i.e., ${\mathbb{E}}_{y\sim {\mathcal{Y}}_c}\left[\mathcal{D}\left(p_{{\theta }^{*}}(·\mid x_t,y)\parallel q_{\mathrm{safe}}(·)\right)\right]$ should be sufficiently small, where $\mathcal{D}(·\parallel ·)$ denotes a distributional distance metric.
• II: high capabilities preservation. For prompts in ${\tilde{\mathcal{Y}}}_c$, the post-erasure distribution should remain consistent with the original distribution $p_{\widehat{\theta }}(·|x_t,y)$, i.e., ${\mathbb{E}}_{y\sim {\tilde{\mathcal{Y}}}_c}\left[\mathcal{D}\left(p_{{\theta }^{*}}(·\mid x_t,y)\parallel p_{\widehat{\theta }}(·\mid x_t,y)\right)\right]$ should be sufficiently small.

By combining these two objectives, the objective function of concept erasure can be formulated as:

$${\theta }^{*}=arg\underset{\theta }{min}\underset{\left(\mathrm{I}\right)\mathrm{Erasure}\mathrm{strength}}{\underbrace{{\mathbb{E}}_{y\in {\mathcal{Y}}_c}\left[\mathcal{D}\left(p_{\theta }(·\mid x_t,y)\parallel q_{\mathrm{safe}}(·)\right)\right]}}+\lambda \underset{\left(\mathrm{II}\right)\mathrm{Capabilities}\mathrm{preservation}}{\underbrace{{\mathbb{E}}_{y\in {\tilde{\mathcal{Y}}}_c}\left[\mathcal{D}\left(p_{\theta }(·\mid x_t,y)\parallel p_{\widehat{\theta }}(·\mid x_t,y)\right)\right]}},$$

(1)

where $\lambda$ is a hyperparameter that balances the two objectives. As $\lambda \to 0$, priority is given to complete erasure; whereas as $\lambda \to \infty$, priority is given to preservation of original capabilities.

Since Equation (1) is formulated based on the true distributions, which are typically unknown and thus difficult to compute and backpropagate directly, we reformulate it as follows.

4.1.2. Distribution-Aligned Proxy

Due to the inaccessibility of the true distributional distance caused by the unknown nature of $p_{\theta }(·|x_t,y)$, we construct a surrogate objective to address this issue. Specifically, within the GVD framework, the model aims to approximate the true forward process $q\left(x_{1:L}\right|x_0)$ with Kullback–Leibler (KL) divergence between the model posterior $p_{\theta }\left(x_{t-1}\right|x_t,y)$ and the true posterior $q\left(x_{t-1}\right|x_t,y)$. Ho et al. [40] further demonstrate that for Gaussian forward processes, each of these KL divergence terms can be exactly or approximately equivalent to a weighted mean squared error (MSE) of the noise prediction network ${\epsilon }_{\theta }(x_t,t,y)$:

$${\mathcal{D}}_{\mathrm{KL}}\left(q(x_{t-1}\mid x_t,x_0)\parallel p_{\theta }(x_{t-1}\mid x_t,y)\right)\propto \omega \left(t\right){∥{\epsilon }_t-{\epsilon }_{\theta }(x_t,t,y)∥}^2,$$

(2)

where $\omega \left(t\right)$ denotes the loss weight at step t. In other words, the model can recover the true denoising posterior distribution by accurately predicting the injected noise; the smaller the error, the closer the generative distribution is to the data distribution. Therefore, we adopt the noise prediction MSE as a surrogate for the distributional distance in Equation (1), with minimizing the MSE being equivalent to aligning the generative and data distributions.

4.1.3. Safe Distribution Proxy

Since the reference distribution $q_{\mathrm{safe}}(·)$ is typically unknown, we construct its proxy by predicting the negatively guided noise. Specifically, prior research [47] has shown that concept erasure effectively reduces the probability of generating a video x that represents the target concept c through the following mechanism: $p_{{\theta }^{*}}\left(x\right)\propto {\displaystyle \frac{p_{\theta }\left(x\right)}{p_{\theta }(y\mid x)}}$, where $y\in {\mathcal{Y}}_c$. Based on the noise-prediction MSE surrogate, we construct the negative guided noise via reparameterization as a surrogate target for the reference distribution:

$${\epsilon }_{\mathrm{neg}}={\epsilon }_{\widehat{\theta }}(x_t,t,⌀)-\eta ({\epsilon }_{\widehat{\theta }}(x_t,t,y)-{\epsilon }_{\widehat{\theta }}(x_t,t,⌀)),$$

(3)

where ${\epsilon }_{\theta }(x_t,t,⌀)$ represents the network’s predictions under an unconditional setting and $\eta$ is a tunable parameter controlling the erasure strength.

By integrating the aforementioned two proxy objectives, we reformulate Equation (1) into the following computable form:

$$\begin{array}{cc}\hfill {\theta }^{*}=arg\underset{\theta }{min}& \underset{\left(\mathrm{I}\right)\mathrm{Erasure}\mathrm{strength}}{\underbrace{{\mathbb{E}}_{y\in {\mathcal{Y}}_c}\left[\omega \left(t\right){∥{\epsilon }_{\theta }(x_t,t,y)-{\epsilon }_{\mathrm{neg}}∥}^2\right]}}\hfill \\ \hfill & +\lambda \underset{\left(\mathrm{II}\right)\mathrm{Capabilities}\mathrm{preservation}}{\underbrace{{\mathbb{E}}_{y\in {\tilde{\mathcal{Y}}}_c}\left[\omega \left(t\right){∥{\epsilon }_{\theta }(x_t,t,y)-{\epsilon }_{\widehat{\theta }}(x_t,t,y)∥}^2\right]}},\hfill \end{array}$$

(4)

which approximates and efficiently realizes a proxy for the original concept erasure objective.

4.2. Multi-Concept Erasure

Let the set of concepts to be erased be denoted as $\mathcal{C}={\left\{c_i\right\}}_{i=1}^m$, with m representing the number of concepts to be erased. For each concept $c_i$, there exists an erasure objective as defined in Equation (4). For clarity, we denote (I) the erasure-strength objective in Equation (4) as $f_i\left(\theta \right)$ and (II) the capability-preservation objective as $g_i\left(\theta \right)$, which are formally defined as follows:

$$\begin{array}{cc}\hfill & f_i\left(\theta \right)={\mathbb{E}}_{y\in {\mathcal{Y}}_{c_i}}\left[\omega \left(t\right){∥{\epsilon }_{\theta }(x_t,t,y)-{\epsilon }_{\mathrm{neg}}∥}^2\right],\hfill \\ \hfill & g_i\left(\theta \right)={\mathbb{E}}_{y\in {\tilde{\mathcal{Y}}}_{c_i}}\left[\omega \left(t\right){∥{\epsilon }_{\theta }(x_t,t,y)-{\epsilon }_{\widehat{\theta }}(x_t,t,y)∥}^2\right].\hfill \end{array}$$

Therefore, for each target concept $c_i$ to be erased, its objective function of single-concept erasure (i.e., Equation (4)) can be expressed as:

$${\theta }^{*}=arg\underset{\theta }{min}{f}_i\left(\theta \right)+\lambda g_i\left(\theta \right).$$

(5)

Furthermore, the multi-concept erasure problem can be succinctly formulated by minimizing the sum of the objective functions (i.e., Equation (5)) for all concepts to be removed, which can be written as:

$${\theta }^{*}=arg\underset{\theta }{min}\sum _{i=1}^m\left[f_i\left(\theta \right)+\lambda g_i\left(\theta \right)\right].$$

(6)

However, due to inherent conflicts among different concept erasure objectives, directly applying Equation (6) can lead to significant degradation in model performance [48], as it fails to achieve an optimal trade-off across multiple objectives.

4.2.1. Conflict Resolution

To achieve optimal conflict resolution, we reformulate Equation (6) as a constrained multi-objective optimization problem, where $f_i\left(\theta \right)$ serves as the objective function and $g_i\left(\theta \right)\le {\tau }_i$ as the constraint with ${\tau }_i$ denoting the threshold for allowable capabilities degradation. Observing the substantial overlap among the safety prompt sets ${\left\{{\tilde{\mathcal{Y}}}_{c_i}\right\}}_{i=1}^m$ associated with different target concepts, we further consolidate the constraint set into a single constraint $\widehat{g}\left(\theta \right)\le \tau$, where $\widehat{g}\left(\theta \right)={\mathbb{E}}_{y\in \widehat{\mathcal{Y}}}\left[\omega \left(t\right){∥{\epsilon }_{\theta }(x_t,t,y)-{\epsilon }_{\widehat{\theta }}(x_t,t,y)∥}^2\right]$ and $\widehat{\mathcal{Y}}={\tilde{\mathcal{Y}}}_{c_1}\cap \cdots \cap {\tilde{\mathcal{Y}}}_{c_m}$ denotes the intersection of these sets. Then, Equation (6) can be reformulated as the following form:

$${\theta }^{*}=arg\underset{\theta }{min}\{f_1\left(\theta \right),f_2\left(\theta \right),\cdots ,f_m\left(\theta \right)\},\mathrm{s}.\mathrm{t}.\widehat{g}\left(\theta \right)\le \tau .$$

(7)

Solving Equation (7) yields an approximate Pareto-optimal solution to the original problem Equation (6), thereby achieving an optimal trade-off across multiple concept erasure objectives.

4.2.2. Computational Implementation

We adopt the MGDA [49] method to solve Equation (7), aiming to identify a common descent direction $\mathit{d}$ satisfying $\nabla f_i{\left(\theta \right)}^{\top }\mathit{d}<0,\forall i=1,\dots ,m$, where $\nabla f_i\left(\theta \right)$ denotes the gradient of the i-th objective function, reducing the parameter gradients of all objectives as much as possible. Specifically, we define $G\left(\theta \right)=\left[\nabla f_1\left(\theta \right),\nabla f_2\left(\theta \right),\dots ,\nabla f_m\left(\theta \right)\right]\in {\mathbb{R}}^{d\times m}$ and seek a weight vector ${\gamma }^{*}$ such that minimizing the norm of the combined gradient:

$${\gamma }^{*}=arg\underset{\gamma }{min}{∥G\left(\theta \right)\gamma ∥}_2^2\mathrm{s}.\mathrm{t}.\gamma \in {\Delta }_m=\{{\gamma }_i\ge 0,\sum _i{\gamma }_i=1\}.$$

(8)

Equation (8) can be reformulated as a standard quadratic programming (QP) problem [50]. By making the QP strictly convex, it can be efficiently solved using any QP solver to obtain ${\gamma }^{*}$. Once ${\gamma }^{*}$ is obtained, the MGDA common descent direction is defined as $\mathit{d}=-{\sum }_{i=1}^m{\alpha }_i^{*}\nabla f_i\left(\theta \right)$, and the parameters are updated accordingly: ${\theta }^{(t+1)}\leftarrow {\theta }^{\left(t\right)}+\rho \mathit{d}$, where $\rho$ denotes the learning rate. Considering the constraint in Equation (7), we adopt a projection method to ensure feasibility. Specifically, after each update, if the new ${\theta }^{(t+1)}$ violates the constraint, we perform a Euclidean projection: ${\widehat{\theta }}^{(t+1)}\leftarrow arg{min}_{\theta :\widehat{g}\left(\theta \right)\le \tau }{∥\theta -{\theta }^{(t+1)}∥}^2$ back onto the feasible region.

4.2.3. Enhanced Framework Extensibility

To further enhance the scalability and enable control over different concept erasure targets with varying priorities or degrees of erasure, we improve upon MGDA by introducing importance weights $\delta ={({\delta }_1,\cdots ,{\delta }_m)}^{\top }$ to scale each column of the gradient in $G\left(\theta \right)$, represented as $G_{\delta }\left(\theta \right)=G\left(\theta \right)\mathrm{diag}\left(\delta \right)=\left[{\delta }_1\nabla f_1\left(\theta \right),{\delta }_2\nabla f_2\left(\theta \right),\cdots ,{\delta }_m\nabla f_m\left(\theta \right)\right]$. The complete procedure of the improved algorithm is illustrated in Algorithm 1.

Algorithm 1 Weighted MGDA for Constrained Multi-Concept Erasure

1: Input: Pre-trained diffusion model parameters $\widehat{\theta }$, target concepts $\mathcal{C}={\left\{c_i\right\}}_{i=1}^m$, video sequence $x_t\sim p_{\mathrm{data}}\left(x\right)$, textual prompts $\mathcal{Y}$, erasure strength $\eta$, constraint threshold $\tau$, importance weights $\delta ={({\delta }_1,\dots ,{\delta }_m)}^{\top }$, learning rate $\rho >0$, max iterations T. 2: Output: Model parameters after concept erasure ${\theta }^{*}$. 3: Initialization: Set ${\theta }^{\left(t\right)}=\widehat{\theta }$ and $t\leftarrow 0$. 4: while $t<T$ do 5:     Compute per-concept gradients: $g_i\leftarrow {\nabla }_{\theta }{f}_i\left({\theta }^{\left(t\right)}\right)$, where $i\in \{1,\dots ,m\}$. 6:     Form weighted gradient matrix: $G_{\delta }\left({\theta }^{\left(t\right)}\right)=\left[{\delta }_1{g}_1,{\delta }_2{g}_2,\cdots ,{\delta }_m{g}_m\right]\in {\mathbb{R}}^{d\times m}$. 7:     Solve QP for combination weights: ${\gamma }^{*}=arg{min}_{\gamma \in {\Delta }_m}\frac{1}{2}{\gamma }^{\top }\left(G_{\delta }{\left({\theta }^{\left(t\right)}\right)}^{\top }{G}_{\delta }\left({\theta }^{\left(t\right)}\right)\right)\gamma$. 8:     Compute common descent direction: $\mathit{d}=-G_{\delta }\left({\theta }^{\left(t\right)}\right){\gamma }^{*}=-{\sum }_{i=1}^m{\gamma }_i^{*}{\delta }_i{g}_i$. 9:     Parameter update: ${\theta }^{(t+1)}\leftarrow {\theta }^{\left(t\right)}+\rho \mathit{d}$. 10:    if $\widehat{g}\left({\theta }^{(t+1)}\right)>\tau$ then 11:        ${\theta }^{(t+1)}\leftarrow arg{min}_{\theta :\widehat{g}\left(\theta \right)\le \tau }{∥\theta -{\theta }^{(t+1)}∥}_2^2$. 12:    end if 13:     $t\leftarrow t+1$ 14: end while 15: return Final erased model parameters ${\theta }^{*}$

5. Experiments

We conduct extensive experiments to evaluate the capability of ConceptVoid in removing safety-critical concepts from text-to-video diffusion models. The evaluation focuses on both the effectiveness of harmful content suppression and the preservation of video quality and semantic alignment. We consider both single-concept and multi-concept erasure scenarios to test the scalability and flexibility of our approach.

5.1. Experimental Setup

5.1.1. Datasets

We use T2VSafetyBench [51], a safety-focused evaluation suite tailored for text-to-video models. It contains 12 critical aspects of video generation safety and construct a malicious prompt dataset including real-world prompts, LLM-generated prompts and jailbreak attack-based prompts. Following recent study [22], we select four categories—Pornography, Public Figures, Copyright & Trademarks, and Sequential Action Risk—to evaluate the effectiveness of concept erasure. We filter out low-quality or meaningless prompts from the dataset. In addition, we adopt VBench [52] to assess the generative capabilities of the model after concept removal.

5.1.2. Models

We evaluate ConceptVoid on three high-performance text-to-video diffusion models:

• CogVideoX-2B (CogX-2B) [3]: a lightweight, 2B-parameter diffusion transformer for text-to-video generation that leverages a 3D causal VAE for spatiotemporal compression, an Expert Transformer with adaptive LayerNorm for deep text–video fusion, and progressive/multi-resolution frame packing to produce coherent short videos (e.g., up to 6 s at moderate resolution) with efficient training and inference.
• CogVideoX-5B (CogX-5B): a higher-capacity 5B-parameter variant that builds on the same architectural innovations (3D causal VAE, Expert Transformer with adaptive LayerNorm, progressive training) to deliver richer semantic modeling and stronger temporal coherence, enabling generation of longer (e.g., 10-s), high-quality videos with complex motion and narrative consistency.
• OpenSora [53]: an open-source, large-scale, cost-efficient video diffusion framework that decouples spatial and temporal attention via a Spatial-Temporal Diffusion Transformer (STDiT) and employs a highly compressive 3D autoencoder for compact representations and accelerated training; it supports flexible synthesis (text-to-video, image-to-video, etc.) of up to 15-s, high-fidelity videos with arbitrary aspect ratios, and emphasizes commercial-level performance at controlled training cost.

All models are tested with 48-frame video outputs at 8 frames per second.

5.1.3. Evaluation Metrics

We adopt the following three metrics to assess both erasure success and generation fidelity:

• Unsafe Generation Rate (UGR) [22]: The proportion of videos containing visible evidence of the harmful concept. Detection is performed via GPT-4-based binary frame-level annotation, and the video-level score is obtained by averaging the binary predictions across all frames in each video.
• Fréchet Video Distance (FVD) [54]: Measures perceptual drift from the original model output. Lower values indicate higher visual and temporal consistency. Here we use sanitized prompts.
• MM-Notox Distance (MMN) [23]: Captures the semantic gap between generated videos and their sanitized prompts. Lower scores reflect better alignment with safe intent.
• Object-Subject Score (OSS): A composite metric computed as the average of the Object Class and Subject Consistency scores from VBench. Higher values indicate stronger semantic relevance and temporal coherence in benign video generation.

All reported metrics (UGR, FVD, MMN, and OSS) are dimensionless quantities, as they are computed from proportions, normalized feature distances, or similarity scores without any physical units.

5.1.4. Compared Methods

We refer to the original, unmodified diffusion model (without any concept erasure) as Original. Since no prior method handles multi-concept removal jointly, we build two baselines by adapting the single-concept erasure technique of [47]. In this approach, a short text description of the undesired concept guides fine-tuning: the model is updated using conditioned and unconditioned scores from a frozen diffusion model to steer generation away from that concept.

• Mix: all target concept prompts are included within the same epoch and erased in one pass.
• Sequential: concepts are removed one at a time, iteratively applying the single-concept erasure.

5.1.5. Training Details

We construct preservation concepts from related concepts that are most affected by erasing the target concept. For example, in the nudity erasure experiments, we set “person” as the preservation concept. All experiments are conducted on the same Ubuntu 20.04 LTS server equipped with a 48-core CPU, 256 GB RAM, and an NVIDIA A800 GPU. On an A800 GPU, unlearning a concept for 10 epochs takes approximately 20 min for CogVideoX-2B and OpenSora, and about 40 min for CogVideoX-5B.

5.2. Main Results

5.2.1. Single-Concept Erasure

We evaluate ConceptVoid under the single-concept erasure setting, where each harmful category is addressed independently. As shown in Figure 1 and

Table 1. Evaluation of Concept Erasure across Safety Categories using UGR, MMN, and FVD. Results are obtained using the Open-Sora model and represent the average over five independent runs (all metrics are dimensionless, and arrows (↑/↓) denote the preferred metric direction).

Category	Original			ConceptVoid
	UGR↓	MMN↓	FVD↓	UGR↓	MMN↓	FVD↓
Pornography	52.3	22.8	151.9	19.5 (↓62.7%)	19.1 (↓16.2%)	148.2
Public Figures	16.2	20.1	175.4	8.9 (↓45.1%)	18.7 (↓6.9%)	172.9
Copyright & Trademarks	77.5	23.0	160.7	42.0 (↓45.8%)	20.9 (↓9.1%)	157.2
Sequential Action Risk	50.0	22.5	293.1	16.5 (↓67.0%)	19.4 (↓13.8%)	289.3

, the method consistently reduces unsafe content across all tested categories, with the Unsafe Generation Rate (UGR) dropping by over 50% on average. These improvements are achieved without sacrificing visual quality or semantic relevance. Fréchet Video Distance (FVD) remains largely stable, indicating minimal perceptual drift, while MM-Notox Distance (MMN) also shows consistent reductions, reflecting improved alignment with safe textual intent.

5.2.2. Multi-Concept Erasure

We evaluate ConceptVoid under the more challenging multi-concept erasure setting, where all harmful concepts are removed jointly in a single optimization procedure.

Table 2. Comparison of Erasure Strategies across Models using UGR and OSS. Each result is averaged over five independent runs and reflects the mean performance across all four harmful content categories (all metrics are dimensionless, and arrows (↑/↓) denote the preferred metric direction).

Method	CogX-2B		CogX-5B		Open-Sora
	UGR↓	OSS↑	UGR↓	OSS↑	UGR↓	OSS↑
Original	42.3	81.2	40.1	82.8	41.7	81.9
Mix	22.7 (↓46.3%)	76.0	20.1 (↓49.9%)	77.5	21.3 (↓48.9%)	76.4
Sequential	28.5 (↓32.6%)	72.3	25.8 (↓35.7%)	73.8	26.9 (↓35.5%)	73.0
ConceptVoid	10.8 (↓74.5%)	78.4	9.5 (↓76.3%)	79.1	8.7 (↓79.1%)	78.8

compares ConceptVoid against two baselines.

Across all three models, ConceptVoid achieves the lowest Unsafe Generation Rate (UGR), with up to 79.1% reduction on Open-Sora. Notably, it maintains high Object-Subject Score (OSS), closely matching the original model in semantic and temporal consistency, while both baselines suffer notable OSS degradation. This confirms ConceptVoid’s ability to suppress diverse unsafe content without compromising generation quality.

The superior performance of ConceptVoid arises from its formulation as a constrained multi-objective optimization problem, which avoids the gradient conflicts and oversuppression often observed in naïve mixing or sequential schemes. As detailed in Algorithm 1, ConceptVoid explicitly balances per-concept gradients through a weighted MGDA step, solving a quadratic program (QP) to obtain optimal combination weights based on concept importance. This yields a unified update direction that minimizes harmful features while preserving general expressiveness. In contrast, the Mix baseline suffers from concept interference, where competing gradients collapse shared features, and Sequential erasure accumulates destructive updates, often leading to oversuppression or forgetting of non-target content. By introducing importance weights and enforcing output-level constraints, ConceptVoid provides fine-grained control and robust erasure behavior, making it well-suited for scalable, real-world safety applications.

5.3. Ablation Study

To evaluate the impact of core components in our design, we perform controlled ablations on ConceptVoid using the Open-Sora model. We vary one factor at a time and measure the Unsafe Generation Rate (UGR↓) and Object-Subject Score (OSS↑), averaged over all four safety categories and five random seeds. Results are summarized in Figure 2.

5.3.1. Effect of Importance Weighting

In ConceptVoid, importance weights ${\gamma }_i$ allow prioritizing specific harmful concepts during joint optimization. Removing this mechanism (i.e., setting all ${\gamma }_i=1$) leads to a noticeable degradation: UGR rises from 8.7% to 12.4% (+42.5%) while OSS drops from 78.8 to 77.2. This confirms that naive equal weighting can dilute suppression focus, making it harder to erase high-priority risks without compromising generality. In contrast, learned ${\gamma }_i$ enables fine-grained, policy-aware moderation control.

5.3.2. Effect of Output-Drift Constraint $\tau$

We examine the role of the output-anchoring constraint $\parallel {\theta }^{(t+1)}-{\theta }^{\left(0\right)}\parallel \le \tau$ in controlling model deviation. Tightening $\tau$ (50% smaller) improves OSS from 78.8 to 79.4 due to stronger preservation of distributional stability, but slightly increases UGR to 9.9%. Conversely, removing the constraint entirely causes significant degeneration—UGR increases to 15.2% and OSS drops to 76.5. These results highlight that $\tau$ acts as a safeguard against catastrophic forgetting and over-erasure, maintaining the model’s ability to generate coherent, safe videos.

5.3.3. Effect of Erasure Strength $\eta$

The step size $\eta$ determines how aggressively ConceptVoid modifies model parameters in each update. A smaller $\eta$ slows down erasure, resulting in incomplete suppression (UGR 11.1%), while a larger $\eta$ reduces UGR slightly (to 8.1%) but harms semantic quality (OSS drops to 77.6). The default setting strikes an effective trade-off between stability and suppression capacity. These findings suggest that $\eta$ should be tuned based on the target application’s tolerance for visual perturbation versus safety guarantees.

6. Conclusions

In this work, we address the challenge of preventing pretrained GVDs from producing harmful or copyright-protected content without resorting to costly full retraining. Specifically, we tackle the problem of simultaneously erasing multiple harmful concepts. To this end, we propose ConceptVoid, a scalable multi-concept erasure framework that formulates multi-concept erasure as a constrained multi-objective optimization problem. For each target concept, we define a removal loss based on the discrepancy between noise predictions conditioned on the concept and those unconditioned, while preserving non-target capabilities through regularization of output distributions and parameter perturbations. We employ the MGDA to solve the resulting optimization problem, achieving Pareto-optimal trade-offs among competing erasure objectives. Additionally, we introduce an importance-weighting mechanism to flexibly adjust the priority and strength of each concept’s removal. Extensive experiments on state-of-the-art GVDs and diverse real-world datasets demonstrate that ConceptVoid effectively suppresses multiple harmful concepts while maintaining high video fidelity and strong scalability.

7. Limitations

Despite its advantages, ConceptVoid has several limitations. Its theoretical Pareto-optimality guarantees hinge on the convexity of both the objective functions and the feasible set; in non-convex scenarios, the framework can only assure weak Pareto optimality or Pareto stability. Furthermore, although ConceptVoid is in principle applicable to other generative architectures (e.g., text-to-image or text-to-text models), its empirical performance beyond video diffusion remains untested. The method also depends on explicit concept prompts and the corresponding conditioned versus unconditioned noise predictions, making it unable to automatically discover or erase novel or unspecified concepts. Finally, solving the constrained multi-objective optimization via MGDA and tuning importance weights for each target concept incurs additional computational overhead, which may limit real-time or resource-constrained deployments.