MANCE: Manifold Aware Concept Erasure

Matan Avitan, Yoav Goldberg, Yanai Elazar

MANCE constrains concept erasure to the natural representation manifold, improving surgicality and leakage.

How can we remove specific concepts from model representations without damaging the underlying data manifold or distorting unrelated information?

Concept erasure aims to remove specific attributes from neural representations, but because concepts are often entangled, unconstrained interventions frequently damage unrelated information. MANCE (MANifold aware Concept Erasure) addresses this by restricting edits to the local tangent space of the natural representation manifold, ensuring updates remain within the region where the model's representations naturally reside. MANCE++ achieves state-of-the-art results, consistently reducing target leakage to near-chance levels while preserving control concepts better than existing nonlinear methods.

Paper Primer

The core move is to treat the representation space as a structured manifold rather than a flat Euclidean space. MANCE estimates this manifold locally for each sample using a tangent basis derived from nearby natural representations, then projects the erasure gradient onto this basis to ensure the edit stays "on-manifold."

MANCE is an iterative algorithm: it repeatedly fits a nonlinear probe to identify the target concept, computes the gradient, and applies a per-sample step size capped by the local neighborhood radius. MANCE+ and MANCE++ prepend closed-form linear and covariance-asymmetry erasers to handle simple signal before the manifold-constrained loop attacks the residual nonlinear structure.

MANCE++ achieves state-of-the-art nonlinear concept erasure.

Across 119 settings, MANCE++ is the only method that consistently combines high coverage with near-floor target leakage while satisfying strict surgicality budgets. In NLP settings, it reaches chance-level leakage on 19–35 out of 39 settings, compared to 13–17 for the strongest baseline, Obliviator.

The manifold constraint is the primary driver of performance gains.

The ablation AmbCE++, which uses the same nonlinear probe loop but takes full-space gradient steps, leaves 6–10 pp higher leakage and fails to satisfy surgicality budgets on many settings. MANCE++ reduces target leakage to near 0.0 pp at a 10 pp surgicality budget, whereas the unconstrained ablation struggles to stay within budget.

Why is this approach better than simply using a stronger nonlinear eraser?

Unconstrained nonlinear erasers often "over-edit" by moving representations into regions of the space that the model never naturally visits, which destroys unrelated information. By constraining the edit to the manifold, MANCE ensures the intervention remains within the model's valid operational range.

What is the primary limitation of this method?

MANCE relies on local tangent space estimation via k-nearest neighbors. Its effectiveness depends on the density of the natural representation pool; if the manifold is strongly curved or the natural data is sparse, the tangent estimate degrades.

Researchers should treat representation editing as a geometry-aware task; constraining interventions to the natural manifold is a robust strategy for improving surgicality in both erasure and activation steering.

Motivation and Manifold Constraint

We expose why unconstrained erasure harms representation utility and propose manifold‑aware edits.

Concept erasure must excise a target attribute while leaving the rest of the representation intact—a tension we call surgicality. Because attributes are often entangled and many remain unknown, naïve edits easily corrupt useful information.

Natural representations cluster on a low‑dimensional surface; any edit should stay on that surface.

Erasing a concept without collateral damage to other encoded information.

**Figure 1.** MCH motivates erasure constrained by the representation manifold. The Manifold Constraint Hypothesis assumes that natural representations concentrate in a structured, lower-dimensional manifold. Under this premise, an unconstrained intervention can change an encoded concept while moving a representation away from the local neighborhood of natural representations, potentially damaging unlabeled control information encoded along the manifold. MANCE operationalizes MCH for concept erasure by estimating the manifold, and projecting the erasure direction onto the manifold.

Unconstrained erasure fails because it ignores the manifold that structures useful information.

The MANCE Mechanism

Manifold‑aware erasure iteratively edits representations while staying on the data manifold.

Naïve concept erasure treats the representation space as flat, so removing a target concept warps the underlying data manifold and harms downstream performance. MANCE addresses this by constraining edits to the locally estimated tangent space of the natural manifold.

Iteratively edit each representation along directions that stay on the data manifold, using a probe‑driven gradient that is re‑projected onto locally estimated tangent spaces.

Compute the neighbor mean $\bar{x}_{N_1}= (x_2+x_3)/2$ and center the neighbors: $x_2-\bar{x}_{N_1}$, $x_3-\bar{x}_{N_1}$.

Form $S_1\in\mathbb{R}^{2\times3}$ with the two centered rows and run SVD: $S_1 = L_1\operatorname{diag}(\sigma_{1,1},\sigma_{1,2})V_1^\top$.

Take the top $r=2$ right singular vectors $v^{(1)}_1,v^{(2)}_1$ to build $B_1=[v^{(1)}_1,v^{(2)}_1]$.

Assume the probe gradient at $x_1$ is $g=\nabla f_t(x_1)=(0.6,-0.2,0.4)$. Normalize: $u_1=g/\|g\|_2$.

Project: $c_1 = B_1^\top u_1$, then reconstruct $B_1c_1$ (the component of $u_1$ that lies in the tangent space).

Reweight spectrally: $d_1 = B_1\operatorname{diag}(\sigma_{1,1},\sigma_{1,2})c_1$ and apply the update $x_1 \leftarrow x_1 - \lambda_1 d_1$ with $\lambda_1 = \min(\varepsilon\,\|B_1c_1\|,\lambda_{\max})$.

The update moves $x_1$ only along directions that are observed in the natural neighborhood, so the edited point remains on the manifold even after multiple rounds.

For each sample $x_i$, collect its $k$ nearest neighbors from the fixed natural set $X^{(0)}$ and compute the local PCA matrix $S_i$.

Perform SVD on $S_i$ and keep the top $r$ right singular vectors to form the tangent basis $B_i$.

Fit (or refit every $\tau$ rounds) a nonlinear probe $f_t$ for the target concept on the current edited representations.

Compute the input gradient $\nabla f_t(x_i)$, normalize to $u_i$, and project onto $B_i$ to obtain coefficients $c_i$.

Form the spectrally‑weighted direction $d_i = B_i\operatorname{diag}(\sigma_i)c_i$.

Choose a per‑sample step size $\lambda_i$ (capped by $\lambda_{\max}$) and update $x_i \leftarrow x_i - \lambda_i d_i$.

Repeat steps 1–6 for $H$ rounds, updating the probe every $\tau$ rounds.

Core MANCE loop – comments describe each semantic chunk.

How is MANCE different from a naïve erasure that simply subtracts the probe gradient?

Naïve subtraction moves the representation in the raw gradient direction, which may point outside the data manifold and destroy useful structure. MANCE first projects the gradient onto the locally estimated tangent space, then reweights by the singular spectrum, ensuring the edit stays within directions supported by natural data and preserving downstream utility.

Algorithmic Implementation

Per‑sample updates keep edits inside each point’s local geometry.

A single global step size either over‑edits easy samples or under‑edits hard ones, which harms both utility and erasure quality. MANCE therefore computes a per‑sample step size that respects each point’s local geometry.

Remove the component of each representation that points along the erasure direction, scaled by a per‑sample step size.

Compute the projection term: $0.5 \times 3 \times [1,0] = [1.5,\,0]$.

Subtract from the original representation: $[3,4] - [1.5,0] = [1.5,\,4]$.

The updated point $\tilde{x}_i = [1.5,\,4]$ retains the original second coordinate, showing that only the component along $\hat{u}_i$ changed.

This example makes clear that the update modifies only the erasure direction while leaving orthogonal dimensions untouched, which is the key to preserving the surrounding manifold.

How does this differ from a standard gradient step that simply subtracts $\lambda_i \nabla L$?

In a plain gradient step the full gradient $\nabla L$ is subtracted, which can alter every latent direction. Here we first project the gradient onto the erasure direction $\hat{u}_i$, so only the component that aligns with the concept is removed; orthogonal components remain unchanged, keeping the representation on its manifold.

A fixed $\lambda$ would still over‑edit some points, so MANCE caps each update by a fraction $\epsilon$ of the local neighborhood radius $r_i$.

Estimate a local tangent basis around each current representation $x_i$.

Project the concept‑probe gradient onto the basis to obtain the direction $d_i$.

Reweight the tangent‑basis coordinates by the local singular spectrum.

Compute the per‑sample step size $\lambda_i$ using the closed‑form Eq (6).

Update the representation with the projection subtraction Eq (3).

Repeat until the erasure criterion is satisfied or a maximum number of iterations is reached.

MANCE+ adds a LEACE preprocessing step that removes class‑mean linear signals; MANCE++ further prepends CovMatch, which eliminates second‑moment covariance asymmetry before the main loop.

Evaluation Framework

We evaluate erasure across a broad suite of 119 diverse settings.

The experimental suite spans 119 distinct settings, providing a comprehensive testbed for concept‑erasure methods.

It includes 39 NLP configurations (13 LLM families × 3 concepts) and 80 CelebA‑CLIP attribute settings.

These metrics and budgets enable a fair trade‑off analysis across baselines and the proposed MANCE family, letting us compare target leakage $| \Delta S |$ while respecting a fixed $D_Y$ limit.

Empirical Performance

Key empirical findings show MANCE++ achieves near‑zero leakage while staying within surgicality budgets.

Recall that standard erasure treats representations as flat Euclidean spaces, which distorts the data manifold; MANCE instead respects the local geometry, preserving utility while removing target concepts.

Obliviator zeroes out the target concept vector without considering the surrounding manifold, yielding limited coverage but low leakage where it does apply.

MANCE++ attains near‑chance leakage (0.0 pp) across every surgicality budget, outperforming all baselines.

At the strictest budget ($D_Y\le1$ pp) leakage drops from +1.6 pp to 0.0 pp, reaching chance on 19–35 of 39 NLP settings; other methods remain above 1.5 pp.

**Figure 2.** **NLP leakage summaries.** (a) Mean leakage across 39 NLP settings. (b) Per-model gender accuracy at two surgicality budgets.

**Figure 3.** **Vision (CelebA): coverage vs. mean target leakage.** Each point is one erasure method: x-axis is coverage (how many of the 40 CelebA attributes it erased within the surgicality budget); y-axis is its mean target leakage over those covered attributes; lower-right is better. Panels pair the two budgets ($D_Y \leq 1\text{pp}$, $D_Y \leq 3\text{pp}$) with the high- and low-correlation control regimes. MANCE++ shows consistent strong tradeoffs between target leakage and coverage, and marks a new pareto curve; Obliviator (orange) matches its low leakage only at far lower coverage, while LEACE, INLP, and IGBP cover many attributes but leave 4–7pp leakage.

**Table.** Across both modalities, we report the four surgicality budgets $D_Y \in \{1, 3, 5, 10\}$pp, meaning average control doesn't drop below the budget relative to the clean (un-erased) representation.

MANCE consistently outperforms baselines in surgicality.

Closed-Form Preprocessing

Closed-form preprocessing removes linear and second‑order concept signals before the manifold loop.

Closed-form preprocessing tackles the linear (mean shift) and second‑order (variance asymmetry) components of a target concept in two analytic steps, leaving only a small nonlinear residual for the manifold‑constrained loop.

The first step (LEACE) eliminates any linear classifier that could recover the concept, and the second step projects out the top two eigenvectors of the class‑conditional covariance difference, so the remaining representation is already close to the “floor” of concept information.

The two stages erase structurally distinct signals (mean shift vs. variance asymmetry) and together remove an effective rank of at most 3, negligible relative to the representation dimension d.

When only LEACE + CovMatch is applied, the Gender concept retains a 14.8 pp residual above the floor, which the subsequent manifold‑constrained loop reduces to 1.0 pp.

Table 3 shows Gender NL = 0.560 + 14.8 pp after preprocessing; the loop drives it down to 1.0 pp.

For the Safety concept, the closed‑form steps leave an 11.5 pp gap that the loop shrinks to 0.2 pp.

Table 3 reports Safety NL = 0.560 + 11.5 pp after preprocessing; after the loop the residual is 0.2 pp.

The hyperparameters $\epsilon$ = 0.1, h = 512, probe‑training steps = 800, and the floor kₘᵢₙ = 8 are fixed across every NLP and CelebA panel, eliminating per‑setting tuning.

TwoNN estimates the intrinsic dimension of the clean representations X(0); we then set the local tangent basis rank r = max(kₘᵢₙ, ⌈TwoNN⌉). The floor of 8 prevents pathological under‑estimation on small or noisy pools.

$\epsilon$ = 0.1 scales each sample’s displacement by a fraction of its local neighbourhood radius rᵢ, automatically adapting to representation scale and density, which explains its robustness across all 119 settings.

For CelebA we construct two control sets per target attribute: the five least‑correlated attributes (|R| < 0.05) and the five most‑correlated attributes (|R| ≈ 0.7–0.8), using the Pearson correlation matrix $R$ computed over the training labels.

Reporting both regimes reveals distinct failure modes: a method that indiscriminately destroys representation passes the least‑correlated test but fails the most‑correlated one, while a method that does nothing passes both.

Table 13 confirms the manifold premise: sycophancy exhibits large local‑global angle misalignment and low intrinsic dimension (34–53), indicating that a single global direction is insufficient to capture the concept.

The anisotropy parameter $\alpha$ controls how strongly the local singular values $\sigma_{i,k}$ weight the tangent direction: $\alpha$ = 0 treats all directions equally, $\alpha$ = 1 (default) scales by $\sigma$, and $\alpha$ = 2 emphasizes high‑variance axes.

How does this closed‑form preprocessing differ from a standard PCA‑based projection that removes the top variance directions?

Standard PCA would discard the top eigenvectors of the overall covariance, regardless of class labels, potentially removing useful information. Our pipeline first eliminates the mean shift (LEACE) and then removes only the top two eigenvectors of the *class‑conditional* covariance difference $\Delta$$\Sigma$, preserving directions that are not discriminative between classes while still erasing the variance asymmetry that a linear probe could exploit.

Computational Efficiency

MANCE++ drives the most attributes to chance while keeping leakage minimal.

MANCE++ drives the most attributes to chance under the 5‑least‑correlated control regime.

35 out of 40 attributes achieve |DS| ≤ 0.5 pp (the in‑budget step closest to chance).

Across both control regimes, MANCE++ consistently outperforms prior baselines such as LEACE and INLP, achieving the highest coverage of attributes driven to chance while maintaining the smallest leakage increase.

Discussion and Implications

We discuss MCH’s broader relevance, MANCE’s limits, and future research directions.

We argue that the Manifold Constraint Hypothesis (MCH) implies a general principle: any representation edit should respect the joint geometry induced by the model and its data, not merely apply arbitrary Euclidean perturbations.

The current limitation of MANCE stems from its reliance on a cheap, local first‑order estimate of the manifold $M$: a per‑representation tangent space $T_{x_i}(M)$ obtained by PCA on $k$ nearest natural representations $X^{(0)}$.

Better, possibly non‑local manifold estimators could enable more precise “surgical” edits and allow a single estimate to serve many different interventions, reducing the need to recompute $M$ for each target.

Our tangent‑space approach degrades when natural representations $X^{(0)}$ are sparse or the manifold is highly curved; the TwoNN intrinsic‑dimension estimate may over‑ or under‑estimate the true rank $r$, limiting the effectiveness of the constraint.

Computationally, MANCE is heavier than closed‑form linear erasers such as LEACE because each edit requires a $k$‑NN query, a local SVD, and periodic refitting of the nonlinear probe, both during training and at deployment.

Our evaluation measures leakage $S$ and surgicality $\Delta Y$ via a fixed nonlinear MLP probe and a set of control concepts; these metrics capture only the probe’s recoverability and the listed controls, not guarantees about full information loss.

Future work should tighten the link between manifold‑estimation quality and formal erasure guarantees, and explore richer geometry‑aware editing primitives beyond the current tangent‑space projection.

Control Set Statistics

Control sets exhibit a broad $\lambda$ spread, from strong negatives to high positives.

The raw $\lambda$ values for each control set are listed below. Most entries are zero, but the extremes span from -4.0 to +39.0.

Supplementary Results

Empirical tables quantify latency, control selection, and geometry across methods.

This section reports the empirical measurements that underpin the paper’s claims: wall‑clock latency of each erasure method, the control attribute sets used to probe surgicality, and statistics on per‑row confidence and geometric alignment.

Table 10 lists, for each of the 40 CelebA target attributes, the five control attributes with the smallest absolute Pearson correlation $|r|$ on the training split. These low‑correlation controls isolate a clean surgicality regime by minimizing shared information with the target.

Table 11 provides the opposite extreme: the five controls with the largest $|r|$ for each target. This high‑correlation set creates a stress test where the erasure method must preserve utility despite strong entanglement between target and controls.

Read the original paper

Open the simplified reader on Paperglide

Browse all simplified papers