Abstract↩︎

Concept erasure aims to remove a target concept from a representation while preserving the other information encoded in it. This is difficult because representations encode many concepts that are often correlated with the erasure target, so removing the target risks damaging them. We propose the Manifold Constraint Hypothesis (MCH): if natural representations concentrate on a structured, lower-dimensional manifold, then interventions should be constrained to that manifold and better preserve other information encoded in the representation during interventions. We instantiate MCH in a new concept erasure method: MANifold aware Concept Erasure (MANCE). MANCE performs iterative updates to the representations using signals from a classifier that predicts a target concept. We estimate the manifold using representations obtained from natural inputs, and then we project the concept removal update to the estimated manifold. We perform extensive evaluation on 119 settings spanning text and vision, including 13 language models, three NLP concepts, and 40 CelebA-CLIP attributes. Employing MANCE on top of previous methods shows consistent improved leakage results. We also introduce MANCE⁺ and MANCE⁺⁺, which prepend a closed-form erasure algorithm before employing MANCE, achieving better leakage–surgicality tradeoffs relative to matched full-space updates. MANCE⁺⁺, our best method, achieves state-of-the-art results on nonlinear concept erasure. These results support MCH in the erasure setting: interventions should be constrained to the natural representation manifold.¹

1 Introduction↩︎

Neural representations encode many attributes of their inputs: semantic content, style, demographic information, task labels, and other latent factors [1]–[8]. In many applications, we want to remove one such attribute (e.g., gender or toxicity), while preserving everything else the representation contains [9], [10]. This is the central tension in concept erasure: removing information about the attribute selected for erasure without unnecessarily damaging other concepts, known as surgicality [11].

Intervening on representations is difficult. Since concepts are often entangled with one another (e.g., profession information and gender), due to data correlation and superposition [12], intervening on one concept may negatively affect another.

A further challenge is that these other concepts are usually unknown. This makes it hard to formulate erasure as a standard constrained optimization problem to remove a concept while preserving others.

We propose the Manifold Constraint Hypothesis (MCH), formalized in 3.1. MCH assumes that representations that arrive from the natural input distribution lie on a manifold. MCH then predicts that interventions constrained to that manifold will be equally effective in concept erasure, while also preserving other concepts encoded in the representation.

We introduce the MANCE family, a series of manifold aware methods for non-linear concept erasure [13]–[17] that operationalizes MCH. The main idea is to perform a targeted erasure by modifying the representations based on some target concept we would like to erase, and constrain the update to remain on the manifold. We implement the targeted erasure using a standard gradient-based approach (e.g., [18]). Then, to perform the constrained update we use local manifold estimation by its neighboring representations obtained from natural inputs [19]. As part of the constrained optimization, we develop a closed-form solution that allows a flexible update based on the manifold’s local geometry. We show that MANCE can be effectively added to any previous erasure method, by applying it on the intervened representations. We also propose two variants of MANCE by prepending closed-form linear stages: MANCE⁺ prepends LEACE [20]; and MANCE⁺⁺ further prepends a rank-2 projection that removes the leading second-moment covariance asymmetry.

We perform a comprehensive evaluation of concept erasure: 119 settings across text and vision, including 39 NLP settings spanning 13 language models and three concepts, plus 80 CelebA-CLIP settings from 40 image attributes under two surgicality regimes. By applying MANCE on previous erasure methods (INLP [15], LEACE [20], and IGBP [21]), we show consistent erasure improvements while minimally harming other concepts. Finally, we show that MANCE⁺⁺ achieves state-of-the-art results on concept erasure, outperforming the strongest baseline [22] under the same limits on control accuracy degradation.

We make the following contributions: (1) We formalize MCH, which predicts that interventions constrained to the natural representations manifold preserve other concepts encoded in the representation while still effectively intervening on the intended concept; (2) we operationalize this prediction for concept erasure through MANCE, a gradient-based erasure method w.r.t. the natural representation manifold, and show that it improves prior erasers performance when applied as an additional step; and (3) we introduce MANCE⁺⁺, a composed variant that adds closed-form preprocessing before MANCE and achieves state-of-the-art results on concept-erasure.

2 Previous Work↩︎

Concept erasure methods aim to remove information about a target concept from neural representations while minimizing damage to the other information those representations encode. Linear methods such as INLP [15] and LEACE [20] target linearly decodable concept information. IGBP [21] and Obliviator [22] remove nonlinear information. IGBP iteratively trains a nonlinear probe and retracts representations toward the current decision boundary; Obliviator approximates a kernel feature map with random Fourier features and iteratively projects out the directions in that feature space that are most predictive of the target concept. A practical limitation of Obliviator is that its erased output is not guaranteed to preserve the original representation dimensionality: the method selects retained feature-space modes through an eigenvalue problem, and the resulting dimension depends on the retained modes. This does not prevent probe-based evaluation, but it limits as-is use in downstream settings where the edited vector must have the original activation dimension before it can be inserted back into the model computation, such as activation patching.

MANCE is orthogonal to the advances in concept erasure in the sense that it can be applied to any previous erasure method. Rather than move in arbitrary directions, MANCE projects the erasure update onto the natural-representation manifold. As such, we employ MANCE in addition to previous concept erasure methods, and demonstrate over a wide range of settings how the manifold constraint improves the surgicality of the edits.

3 The MANCE Algorithms Family↩︎

3.1 The Manifold Constraint Hypothesis↩︎

Hidden states produced by natural inputs do not fill the full representation space uniformly. We assume that they instead occupy a structured, lower-dimensional region shaped by the encoder and the data distribution, which we model as a manifold \(\mathcal{M} \subset \mathbb{R}^d\), where \(d\) is the representation dimension.

We call an intervention \(\mathbf{x} \mapsto \mathbf{x} + \boldsymbol{\delta}\) constrained to the manifold when it moves the representation along \(\mathcal{M}\), so that the edited point \(\mathbf{x} + \boldsymbol{\delta}\) remains on \(\mathcal{M}\). This condition is stated with respect to \(\mathcal{M}\) itself, independent of how the manifold is modeled or estimated. By contrast, an intervention is unconstrained when \(\boldsymbol{\delta}\) may point anywhere in \(\mathbb{R}^d\), at any magnitude.

The Manifold Constraint Hypothesis (MCH) posits that, among interventions with a matched effect on the target concept, manifold-constrained interventions preserve other concepts encoded in the representation better than unconstrained interventions. MANCE, presented next, operationalizes MCH by estimating a first-order approximation to the manifold using tangent directions obtained from natural inputs.

3.2 The MANCE method↩︎

MANifold aware Concept Erasure (MANCE) operationalizes MCH (3.1) as a manifold-constrained erasure operation on representations. Given initial representations \(\mathbf{X}^{(0)} \in \mathbb{R}^{N \times d}\), where \(N\) is the number of samples, \(d\) is the representation dimension, row \(i\) is \(\mathbf{x}_i^{(0)}\), and the target-concept labels are \(\mathbf{y}=(y_1,\ldots,y_N)\), MANCE fits a nonlinear concept probe \(f_t : \mathbb{R}^d \to \mathbb{R}\) at each round \(t\), computes the gradient of the probe’s target prediction with respect to each input representation, and edits only the locally manifold-supported part of that gradient. We present the method for binary target labels.² The method has three ingredients: (1) estimate the local manifold from representations \(\mathbf{X}^{(0)}\) obtained from natural inputs; (2) project the erasure gradient onto the span of those local directions; and (3) choose a per-sample step size, small enough that the edit stays inside the manifold.

3.2.0.1 Notation.

Representations \(\mathbf{x}_i\) lie in \(\mathbb{R}^d\). We write \(\mathcal{M}\) for the representation manifold and \(T_{\mathbf{x}_i}(\mathcal{M})\) for its tangent space at \(\mathbf{x}_i\): the linear subspace that approximates \(\mathcal{M}\) to first order near \(\mathbf{x}_i\), i.e.,the directions one can move along while remaining on \(\mathcal{M}\) [23]. The method is controlled by the following scalars: \(H\), the number of erasure rounds; \(\tau\), the probe-refit period (defined below); \(k\), the neighborhood size; \(r\), the number of local directions retained (the tangent rank); \(\lambda_i\), the per-sample step size; \(\varepsilon\), the update size as a fraction of the local neighborhood radius; \(\lambda_{\max}\), a cap on any single step; and \(\alpha\), the spectral-weighting exponent. A probe refit means retraining the MLP probe from scratch on the current edited representations and the same target labels. We do this every \(\tau\) rounds, rather than every round, for efficiency; we fix \(\tau=8\) across all settings (see App. 12). Refitting matters because after an edit removes the currently easiest target-concept signal, a new nonlinear probe can expose residual information about the erased concept that the next tangent-constrained step should remove.

3.2.0.2 Summary of MANCE.

MANCE is an iterative algorithm for nonlinear concept erasure. At each step it computes a nonlinear concept probe and obtains its gradients w.r.t. the inputs. Crucially, it constrains the gradient update to the manifold of the natural representation (produced by natural inputs, not related to the representations we remove the concept from). Concretely, it repeatedly estimates a local tangent basis (using natural inputs representation) around each current representation to edit, projects the concept probe’s gradient into that basis, reweights the tangent-basis coordinates by the local singular spectrum, and applies the largest per-sample update allowed by the local neighborhood radius. At a high level, each round uses the current nonlinear concept probe, recomputes local tangent bases, applies the per-sample update to every representation, and returns \(\mathbf{X}^{(H)}\) after \(H\) rounds.

3.2.0.3 Step 1: Estimate the manifold locally.

The first step is to estimate the representation manifold that will constrain the edits. The representation manifold is unknown, but estimating it globally is unnecessary for an edit at one point. For each representation \(\mathbf{x}_i\), we instead estimate the local tangent space \(T_{\mathbf{x}_i}(\mathcal{M}) \subset \mathbb{R}^d\), the linear subspace that first-order approximates \(\mathcal{M}\) near \(\mathbf{x}_i\) from the other representations obtained from natural inputs.

Let \(\mathcal{N}_k(\mathbf{x}_i)\) be the \(k\) nearest neighbors of \(\mathbf{x}_i\) among the natural (unedited) representations \(\mathbf{X}^{(0)}\), and let \(\bar{\mathbf{x}}_{\mathcal{N}_i}\) be their mean. These neighbors provide local samples of how natural representations vary around \(\mathbf{x}_i\). We form a local PCA matrix by mean-centering the neighbor positions, with one row \(\mathbf{x}_j - \bar{\mathbf{x}}_{\mathcal{N}_i}\) for each neighbor \(\mathbf{x}_j \in \mathcal{N}_k(\mathbf{x}_i)\). Arranging these \(k\) centered local variation samples as rows gives \(\mathbf{S}_i \in \mathbb{R}^{k \times d}\). We then compute SVD on \(\mathbf{S}_i\) to summarize them into the dominant directions of nearby variation: \[\label{eq:local95pca95svd} \mathrm{SVD}(\mathbf{S}_i) = \mathbf{L}_i \, \mathrm{diag}(\sigma_{i,1}, \ldots, \sigma_{i,k}) \, \mathbf{V}_i^\top.\tag{1}\] The right singular vectors are the local directions in which neighbors extend, and the singular values measure how far the centered neighborhood extends along each direction. Following local tangent-space approximation methods such as LTSA [19], we keep the top \(r\) right singular vectors as a tangent-basis matrix whose column span is our estimate of \(T_{\mathbf{x}_i}(\mathcal{M})\): \[\mathbf{B}_i = [\mathbf{v}_i^{(1)}, \ldots, \mathbf{v}_i^{(r)}] \in \mathbb{R}^{d \times r}, \qquad \boldsymbol{\sigma}_i = (\sigma_{i,1}, \ldots, \sigma_{i,r}).\] \(\mathrm{span}(\mathbf{B}_i)\) is the estimated tangent space \(T_{\mathbf{x}_i}(\mathcal{M})\). The columns of \(\mathbf{B}_i\) form the basis for that subspace, so the edit is constructed by first expressing the probe’s gradient in this local tangent basis and then mapping the resulting tangent-basis coordinates back to representation space. The rank \(r\) is the number of tangent-basis directions retained. It should be small enough to avoid unsupported directions while large enough to capture the local geometry; when \(r\) is not set directly, we estimate the intrinsic dimension of the current representations once with the TwoNN method of [24] and keep that rank fixed throughout the editing loop. Although \(r\) is fixed, we recompute the local tangent basis \(\mathbf{B}_i\) for each sample at every erasure round. The basis is re-estimated at the sample’s current (edited) position \(\mathbf{x}_i^{(t-1)}\), but the neighborhood it is estimated from is always drawn from the fixed natural representations \(\mathbf{X}^{(0)}\). Thus, as a point is edited it queries a new neighborhood of the natural representations: the tangent reflects how natural representations vary near the edited location, rather than how the already-edited points vary among themselves. This keeps the manifold estimate anchored to the manifold (the region MCH posits we should stay within) while still tracking the moving edit location.

3.2.0.4 Step 2: Build the tangent erasure direction.

After estimating the local tangent basis \(\mathbf{B}_i\), we turn the concept probe’s gradient into a concept-erasure direction expressed in that basis. At erasure round \(t\), the probe’s gradient tells us how changing a representation changes the current concept probe’s target prediction. For sample \(i\), normalize this input gradient, \[\mathbf{u}_i = \frac{\nabla f_t(\mathbf{x}_i)}{\|\nabla f_t(\mathbf{x}_i)\|_2}.\] Projecting onto the local tangent basis gives the vector of tangent-basis coordinates, i.e., the weights of the normalized gradient along the columns of \(\mathbf{B}_i\): \[\mathbf{c}_i = \mathbf{B}_i^\top \mathbf{u}_i, \qquad \mathbf{B}_i\mathbf{c}_i = \mathbf{B}_i\mathbf{B}_i^\top\mathbf{u}_i.\] The norm of \(\mathbf{B}_i\mathbf{c}_i\) is at most one, so the update is automatically attenuated when the gradient has little support in the estimated tangent space.

We then form the spectrally-weighted tangent direction by reweighting each tangent-basis coordinate by its singular value, giving more mass to basis directions that are well supported by nearby natural representations and less mass to thin directions with little local variation. The coordinate \(c_{i,\ell}\) is the \(\ell\)th entry of \(\mathbf{c}_i\): \[\label{eq:tangent95direction} \mathbf{d}_i \;\triangleq\; \mathbf{B}_i\operatorname{diag}(\boldsymbol{\sigma}_i^\alpha)\mathbf{c}_i \;=\; \sum_{\ell=1}^{r}\sigma_{i,\ell}^{\alpha}\,c_{i,\ell}\,\mathbf{v}_i^{(\ell)}.\tag{2}\] We use \(\alpha=1\) in all the experiments; Appendix 18 discusses the interpretation of different values of \(\alpha\).

The goal of the update is to reduce the part of the current representation aligned with its local erasure direction. We therefore normalize \(\mathbf{d}_i\) to \(\hat{\mathbf{u}}_i = \mathbf{d}_i / \|\mathbf{d}_i\|_2\) and subtract the \(\hat{\mathbf{u}}_i\)-component of \(\mathbf{x}_i\), scaled by the per-sample step size \(\lambda_i\) chosen below: \[\label{eq:tangent95erase} \tilde{\mathbf{x}}_i \;=\; \mathbf{x}_i \;-\; \lambda_i \,\langle \mathbf{x}_i,\, \hat{\mathbf{u}}_i\rangle\, \hat{\mathbf{u}}_i .\tag{3}\]

3.2.0.5 Step 3: Choose a per-sample local-neighborhood cap.

A single global step size can over-edit some samples and under-edit others, so MANCE determines \(\lambda_i\) separately for each sample \(i\). Given the tangent direction \(\mathbf{d}_i\), \(\lambda_i\) is chosen to make the largest bounded erasure update that stays within a local-neighborhood cap. The cap limits the displacement to an \(\varepsilon\) fraction of the distance from \(\mathbf{x}_i\) to its nearby representations: \[\label{eq:local95radius95cap} \|\tilde{\mathbf{x}}_i - \mathbf{x}_i\|_2 \;\le\; \varepsilon \cdot r_i .\tag{4}\] This keeps the first-order tangent approximation local: the farther the update moves from the neighborhood used to estimate \(\mathbf{B}_i\), the less the local tangent basis describes the geometry around the edited point. The per-sample neighborhood radius is \[\label{eq:r95i95def} r_i \;=\; \frac{1}{k}\sum_{j\in\mathcal{N}_k(\mathbf{x}_i)} \|\mathbf{x}_j - \mathbf{x}_i\|_2 ,\tag{5}\] i.e., the mean distance from \(\mathbf{x}_i\) to its \(k\) nearest neighbors among the natural representations \(\mathbf{X}^{(0)}\). Substituting Eq. 3 into Eq. 4 and solving for the largest feasible \(\lambda_i\) gives the closed-form per-sample step size \[\label{eq:lambda95closed95form} \lambda_i \;=\; \min\!\left(\; \lambda_{\max} \;,\; \frac{\varepsilon \cdot r_i}{\bigl|\langle \mathbf{x}_i,\,\hat{\mathbf{u}}_i\rangle\bigr|} \;\right).\tag{6}\] Thus \(\lambda_i\) is the largest step along \(\hat{\mathbf{u}}_i\) that satisfies the local-neighborhood cap, subject to the hard upper bound \(\lambda_{\max}\). The parameter \(\varepsilon\) sets the intended displacement as a fraction of the local neighborhood radius \(r_i\); if \(\lambda_{\max}\) is smaller than the cap-implied step, the actual displacement is smaller. Because \(r_i\) is itself a per-sample, per-panel quantity computed from the local representations, \(\varepsilon\) is dimensionless in the panel’s representation scale and transfers across settings without per-setting tuning (Appendix 14).

In summary, MANCE repeatedly estimates a local tangent basis around each current representation, projects the concept probe’s gradient into that basis, reweights the tangent-basis coordinates by the local singular spectrum, and applies the largest per-sample update allowed by the local neighborhood radius. Algorithm 2 gives the complete editing loop. The variants below are optional preprocessing steps that run before this loop; they are not additional stages required by core MANCE.

3.2.0.6 MANCE⁺ & MANCE⁺⁺

We propose two additional variants of MANCE that appends another step that complements the concept removal. Before running the MANCE loop, we remove dataset-level moment structure that already has simple closed-form erasers. MANCE⁺ prepends LEACE [20], which removes first-moment linear signal associated with class means. MANCE⁺⁺ additionally prepends CovMatch, a rank-2 specialisation of \(k\)-LEACE [11] that removes second-moment class-conditional covariance asymmetry, represented by the leading eigenvectors of \(\Delta\mathbf{\Sigma} = \mathbf{\Sigma}_+ - \mathbf{\Sigma}_-\). Both are one-shot affine projections of effective rank \(\le 3\) (negligible relative to representation dimension \(d \in [768, 5376]\) across our settings); implementation details for CovMatch and its preprocessing ablation are in Appendix 8.

4 Experimental setup↩︎

We use two standard evaluation metrics from the concept erasure literature, that take as input a representation, train a probe to predict some target concept, and report the performance of such probe on the test set. Target leakage measures the performance of the probe on target concept, and surgicality measures the performance on a set of control concepts.

4.1 Metrics↩︎

4.1.0.1 Target leakage \(S\).

To quantify the remaining information about an erased concept, following [14] we train a new nonlinear probe on the representations and denote its accuracy on the test set by \(S\).³ We compare \(S\) with the majority-vote baseline, denoted \(S_{\text{floor}}\); values near \(S_{\text{floor}}\) indicate that the erased information is no longer recoverable by this probe. We denote \(D_S\) as the difference between the probe accuracy and the majority-vote baseline, \(D_S := S - S_{\text{floor}}\). For model selection and at-chance counts we use \(|D_S|\), since erasure quality depends on distance from chance. Tables report the signed \(D_S\) at the selected step only to show whether the final probe is over-erasing.

4.1.0.2 Surgicality \(\Delta Y\).

We measure surgicality as the damage to control concepts. Each setting defines a control concept, and reports the test set accuracy of a trained probe on the original representations \(Y_{\text{clean}}\) and on the representations \(Y_{\text{edit}}\). We measure the difference between the two: \(\Delta Y = Y_{\text{edit}} - Y_{\text{clean}}\), where negative values indicate control degradation; an ideal surgical edit has \(\Delta Y \approx 0\).

4.1.0.3 Surgicality budget \(D_Y\).

To compare erasure methods fairly, we evaluate them under fixed limits on how much they may degrade control-concept accuracy. For each budget, and for each method, we choose the trajectory step that gives the strongest target erasure while still satisfying that limit. We define the non-negative control-degradation measure \(D_Y = \max(0,\, -\Delta Y)\), so only decreases in control accuracy count against the budget; improvements in control accuracy count as zero degradation. An edit is within budget \(b\) when \(D_Y \le b\). Iterative erasers produce a sequence of edited representations, with different points along the sequence trading off target leakage against control degradation. Among the steps that are within budget, we report the step with the smallest target leakage, measured by \(|D_S|\). We report budgets \(D_Y \le b\) for \(b \in \{1, 3, 5, 10\}\) pp. Throughout, pp abbreviates percentage points: all leakage (\(D_S\)) and surgicality (\(\Delta Y\)) quantities are differences between accuracies, expressed in points on the \(0\)–\(100\) scale.

4.1.0.4 Coverage.

A method need not satisfy a given budget \(b\) on every setting: an eraser may exceed \(b\) at all of its trajectory steps. We define coverage as the number of settings, out of the total \(N\), on which a method has at least one within-budget edit, reported as \(n/N\). Because \(|D_S|\) is averaged only over covered settings, coverage and leakage must be read together: a small mean \(|D_S|\) over few covered settings is weaker evidence of erasure than the same value over all of them.

4.2 Settings, methods, and hyperparameters↩︎

4.2.0.1 Settings and probe.

We perform extensive evaluations of our methods and previous baselines on 119 settings: 39 NLP settings (13 LLM families \(\times\) 3 concepts at the 50%-depth layer of each model) and 80 CelebA-CLIP settings (CLIP ViT-B/32 [25] final-layer pooled image embeddings of CelebA [26]; 40 binary facial attributes \(\times\) 2 surgicality regimes). The 13 LLMs span 0.5B–27B parameters: Qwen2.5 (0.5B, 1.5B, 3B), Gemma-2 (2B, 9B, 27B), Gemma-3 (1B, 4B, 12B, 27B), Llama-3.2 (1B, 3B), Mistral-7B-v0.1. The three NLP concepts are sycophancy [27], gender (Bias in Bios [9]), and safety (PKU-SafeRLHF [28]). The control concepts for these three datasets are answer preference for sycophancy, profession for gender, and helpfulness for safety, respectively. In PKU-SafeRLHF, examples are response pairs; we use the dataset’s helpfulness preference within each pair to label the preserved control concept, while the safety annotation defines the erasure target.

For CelebA, we use each of the 40 attributes as the erasure target under two surgicality regimes: highly entangled and highly disentangled control concepts. These two regimes are formed from the five attributes most and least correlated with the target concept on the training split, respectively. For example, when erasing Male, the most-correlated controls are Wearing_Lipstick (\(|r| \approx 0.80\)), Heavy_Makeup, No_Beard, Attractive, and 5_o_Clock_Shadow. The resulting control sets, with their \(|r|\) values, are listed in App. Tabs. 11 and 12; additional construction details are in App. 15.

4.2.0.2 Baselines.

In addition to the MANCE family, we compare against several baselines. LEACE [20] and LEACE + CovMatch are closed-form one-shot linear and rank-2 covariance erasers. INLP [15] is an iterative linear nullspace projection method. IGBP [21] is an iterative 2-class probe with Newton-step boundary projection. Obliviator [22] is the current state-of-the-art nonlinear method, which iteratively trains an encoder to minimize statistical dependence between the representation and the erased attribute while preserving task-relevant information, and then applies an RKHS-based disentanglement step to refine the representation for the next round.

4.2.0.3 Ablation.

To isolate the value of the tangent constraint, we introduce AmbCE⁺⁺, a controlled variant of MANCE⁺⁺ that uses the same preprocessing and nonlinear probe loop but removes the tangent projection. Instead of projecting the concept-probe gradient into the local tangent basis and scaling the step by the per-sample local-radius cap, AmbCE⁺⁺ takes a full-gradient step in the full representation space with a single global step size, \(\lambda=29.31\). This value is the mean per-sample \(\lambda_i\) produced by MANCE⁺⁺ on the NLP settings (App. Tab. 13), making the ablation comparable in effective step scale. Thus, AmbCE⁺⁺ tests whether the gains come from the tangent constraint rather than from the nonlinear probe loop alone, directly testing the MCH prediction (§3.1).

4.2.0.4 Evaluation protocol.

For every setting we fit the concept eraser on the training representations and evaluate each trajectory step on the held-out test split, reporting both target leakage \(S\) and surgicality \(\Delta Y\). The NLP datasets do not share a standard split, we therefore impose one uniform protocol: we pool the examples, take a stratified subsample of \(12{,}000\), and draw a stratified \(60/20/20\) split, giving \(7{,}200\) train / \(2{,}400\) val / \(2{,}400\) test per setting. CelebA already provides an official train/val/test partition, which we keep, subsampling within each to \(1{,}200\) / \(300\) / \(300\) images per setting. In all cases the eraser is fit on train, the val split only early-stops the probes, and both \(S\) and \(Y\) are reported on the held-out test split. The new nonlinear MLP defined in 4.1 measures target leakage \(S\), and an independent control evaluator measures \(Y\) on the corresponding control task or control attributes. For the NLP settings, each dataset comes with the target and control concepts. For CelebA, we compute \(S\) on each of the 40 attributes, and \(Y\) as the mean accuracy on the regime’s five control attributes. Across both modalities, we report the four surgicality budgets \(D_Y \in \{1, 3, 5, 10\}\)pp, meaning average control doesn’t drop below the budget relative to the clean (un-erased) representation.

4.2.0.5 Hyperparameters.

All step-controlling hyperparameters are fixed across the 119 settings with no per-setting tuning; values are reported in App. 12.

5 Results↩︎

We evaluate the MANCE algorithms family (§3), and previous erasure methods as baselines. We test all methods on 119 settings: 39 from NLP, spanning 13 language models and three concepts, plus 80 from vision, using CelebA with 40 image attributes (the concepts we erase in the vision setting) under two surgicality regimes defined by target–control label correlation: high-correlation (5 most-correlated controls) and low-correlation (5 least-correlated controls). We use this correlation as a measurable proxy for representational entanglement, a relationship correlation is expected to induce [12]. For iterative methods (e.g., INLP), we run the evaluation metrics for each iteration. Then, per surgicality budget, we select the iteration that erases the most of the target concept. In the non-iterative methods, we simply use the obtained, single result.

5.0.0.1 Adding MANCE improves prior erasers.

Applying MANCE on intervened representations from other erasers leads to improved results across most settings. 1 reports leakage gains obtained by applying MANCE after each erasure method, aggregated over the \(39\) NLP settings (\(13\) LLMs \(\times\) three concepts: sycophancy, gender, and safety; see §4.2). Under the same surgicality budgets, adding MANCE drives each baseline’s target leakage close to chance: at \(D_Y \le 1\)pp it falls from \(19.1\) to \(1.5\)pp for LEACE, \(15.2\) to \(1.8\)pp for INLP, and \(11.5\) to \(1.6\)pp for IGBP, with similar drops at the looser budgets, and it keeps as many or more settings within budget (1). The only exception is Obliviator, where we see no improvement in leakage. However, Obliviator’s coverage (§4.1) is only \(13\)–\(19/39\); on those few covered settings its leakage is already down to random, so MANCE has nothing left to remove. This apparent strength is an artifact of which settings it reaches. Next, we will show how for harder, highly correlated settings, MANCE⁺⁺ outperforms Obliviator (and other baselines).

2pt

5.0.0.2 MANCE⁺⁺ gives the strongest leakage–surgicality tradeoff.

[tab:main_results_unified,fig:nlp_results_summary] present the NLP comparison and 4 the vision comparison; complete per-setting results appear in the appendix (NLP in [tab:per_panel_breakdown,fig:per_model_bars_gender_full,fig:per_model_bars_sycophancy_app,fig:per_model_bars_safety_app], vision in [tab:celeba_unified_summary,fig:per_attr_bars_celeba]). Both modalities show the same trend: MANCE⁺⁺ outperforms all baselines, setting a new state of the art in nonlinear concept erasure. On the NLP settings, MANCE⁺⁺ is the only method that stays near chance at every budget: \(+1.6 \to 0.0\)pp from \(\le 1\)pp to \(\le 10\)pp, reaching chance on \(19\)–\(35/39\) settings. On the other hand, the strongest baseline, Obliviator, retains \(+4.3 \to +2.7\)pp above the majority-vote and reaches chance on \(13\)–\(17/39\). In the vision setting (4), under the same configuration and preprocessing as on NLP, MANCE⁺⁺ is the only method that combines high coverage with near-floor leakage. The high-coverage baselines (LEACE, INLP, and IGBP) reach most or all attributes but leave \(4\)–\(7\)pp of leakage; the only other near-floor method, Obliviator, instead attains far lower coverage.

In the least-correlated regime, MANCE⁺⁺ covers \(39/40\) and \(40/40\) attributes at \(D_Y \le 1 pp\) and \(D_Y \le 3 pp\), respectively, compared with \(15/40\) and \(29/40\) for Obliviator. In the most-correlated regime, MANCE⁺⁺ covers \(19/40\) and \(34/40\) attributes, respectively, compared with \(2/40\) and \(15/40\) for Obliviator. Obliviator’s near-floor leakage in 4 is biased by coverage: it is averaged only over the easy attributes Obliviator stays in budget, where MANCE⁺⁺ also reaches the floor. Because MANCE⁺⁺ stays within the surgicality budget on the harder attributes too, it additionally reaches near-chance erasure there, whereas Obliviator has no in-budget result to report (complete per-attribute values in [tab:celeba_unified_summary,fig:per_attr_bars_celeba]). Thus, across text and vision, tangent-based erasure is more effective under the same surgicality budgets, providing empirical support for MCH (Sec. 3.1).

4pt

5.0.0.3 The gain is largest where the target is hardest to remove surgically.

MANCE⁺⁺’s advantage over the baselines is largest where the target is hardest to remove without damaging the control concepts. In NLP this is clearest on gender, where profession strongly correlates with gender: MANCE⁺⁺ reaches chance on \(3/13\) models versus \(0/13\) for Obliviator at \(D_Y \le 1\)pp, widening sharply to \(12/13\) versus \(0/13\) at \(D_Y \le 5\)pp (3 (b); App. 5 4). Safety is intermediate: MANCE⁺⁺ reaches chance on \(11/13\) models, while Obliviator overshoots the budget on \(2/13\) settings at \(D_Y \le 1\)pp (App. 7). On the other hand, Sycophancy is already solved by linear erasure methods, leaving nothing for MANCE to add (App. 6 3). Finally, the vision setting shows the same pattern, where the difficulty is measured directly as target–control correlation: under the most-correlated controls MANCE⁺⁺ keeps far more attributes within budget than Obliviator while staying near the target leakage floor (4).

5.0.0.4 The manifold constraint makes erasure precise and surgical.

The unconstrained ablation AmbCE⁺⁺ matches MANCE⁺⁺ but takes full-space gradient steps of the same effective magnitude (the average \(\lambda\) over MANCE⁺⁺’s iterations, \(\lambda{=}29.31\); App. Tab. 13). Without the manifold constraint it leaves \(6\)–\(10\)pp leakage, and on many settings no step of its trajectory stays within the surgicality budget; by the coverage protocol (§4.1) those out-of-budget settings are excluded from its leakage mean, so even that \(6\)–\(10\)pp is measured only over the easier settings it keeps in budget. Compared with MANCE⁺⁺’s \(+1.6 \to 0.0\)pp, the gains come from the manifold constraint, not the closed-form preprocessing or the nonlinear probe loop alone.

5.0.0.5 The latency tradeoff.

We benchmark the latency of the different methods on the Gender concept. MANCE takes about eight minutes (\(458.8\)–\(474.9\) s across the three variants on one NVIDIA B200), with the closed-form preprocessing in MANCE⁺/MANCE⁺⁺ adding only a few seconds on top; the baselines range from a few seconds (LEACE, CovMatch) to a few minutes (INLP) (10, §13). Profiling attributes roughly \(50\%\) of the runtime to the per-round local SVDs and \(40\%\) to CPU–GPU transfers and CPU-side projection arithmetic. Both are properties of the current implementation rather than of the algorithm, and a fully GPU-resident implementation would reduce the runtime severalfold.

5.0.0.6 Summary.

Across the 119 settings, we observe consistent results: Applied to the representations produced by previous erasure methods, MANCE further improves erasure at equal or better coverage under the same surgicality budget. In addition, our MANCE⁺⁺ variant achieves state-of-the-art concept-erasure results across various models, datasets, and modalities. Our results provide strong empirical support for the Manifold Constraint Hypothesis (§3.1): constraining edits to locally supported directions improves surgical concept erasure.

6 Discussion↩︎

We believe MCH’s effectiveness go beyond concept erasure: interventions on representations should respect the geometry that the model and the data induce jointly, rather than unconstrained modifications. In this work, we study erasure, but the same argument should apply to other representation editing such as activation steering [29], [30].

Our method is limited by how well we can estimate \(\mathcal{M}\). MANCE uses a local, first-order estimate, a per-representation tangent space that is cheap and transfers across models and modalities without per-setting tuning. We believe that better manifold estimators, including non-local and more global models of \(\mathcal{M}\), would enable more surgical interventions and let one estimate serve different edits instead of being recomputed for each representation. Improving manifold estimation, and relating its quality to guarantees on interventions, is in our view a promising path toward geometry-aware interventions.

7 Conclusion↩︎

We proposed the Manifold Constraint Hypothesis: if natural representations concentrate on a manifold, then interventions constrained to the manifold should preserve other information encoded in the representation. MANCE instantiates this hypothesis for concept erasure: it estimates the manifold from neighboring representations, follows the nonlinear concept probe toward reduced leakage, and confines the update to the manifold.

We perform extensive experiments using 119 settings spanning text and vision models and datasets: three NLP concepts (sycophancy, gender, safety) tested on 13 language models, and 40 CelebA-CLIP attributes. MANCE improves leakage–surgicality tradeoffs relative to unconstrained updates and improves prior erasure methods under the same surgicality budget. These results support the Manifold Constraint Hypothesis which is useful for erasure, while leaving better manifold estimators and formal links between tangent-estimation quality and erasure guarantees for future work.

Limitations↩︎

7.0.0.1 Measurement scope.

We quantify erasure by retraining a nonlinear MLP probe on the edited representations, following the recoverability protocol of [14], and we quantify preservation by accuracy on the labeled control concepts. Both target leakage \(S\) and surgicality \(\Delta Y\) are thus empirical measurements under a fixed probe protocol rather than guarantees that the target concept is fully unrecoverable. Surgicality in particular speaks only to the control concepts we enumerated (Sec. 4.2), not to the full information content of the representation.

7.0.0.2 Local manifold estimation.

MANCE constrains each edit to a local tangent space \(T_{\mathbf{x}_i}(\mathcal{M})\) estimated by local PCA over the \(k\) nearest natural representations \(\mathbf{X}^{(0)}\), with the tangent rank \(r\) taken from a TwoNN intrinsic-dimension estimate. This estimate degrades where the natural representations \(\mathbf{X}^{(0)}\) are sparse or the manifold is strongly curved. The tangent constraint also helps only to the extent that MCH holds, that is, that representations concentrate on a structured, lower-dimensional manifold, so its advantage over full-space editing is expected to shrink as the intrinsic dimension approaches the representation dimension \(d\).

7.0.0.3 Computational cost.

Unlike closed-form linear erasers such as LEACE, which apply a single affine map, MANCE recomputes a \(k\)-NN query and a local SVD for every representation at every round and periodically refits the nonlinear probe. Applying the fitted eraser to new inputs likewise requires querying the natural representations \(\mathbf{X}^{(0)}\) for their nearest neighbors, so both fitting and deployment are heavier than one-shot projection methods.

8 Closed-form preprocessing details↩︎

The two MANCE preprocessing variants (MANCE⁺ and MANCE⁺⁺) exhaust 1st- and 2nd-moment concept signal in closed form so that the subsequent manifold-constrained loop only has to attack the residual nonlinear pocket.

8.0.0.1 LEACE (1st moment).

Fit a LEACE eraser [20] on \((\mathbf{X}_{\text{train}}, \mathbf{y})\) and apply to all splits. LEACE removes the rank-1 cross-covariance \(\mathbf{\Sigma}_{xz}\), leaving no linear classifier above majority-class accuracy with provably minimum representation damage among affine projections.

8.0.0.2 Covariance-asymmetry projection (2nd moment).

LEACE matches class means but leaves the within-class asymmetry \[\label{eq:delta95sigma} \Delta\mathbf{\Sigma} = \mathbf{\Sigma}_{+} - \mathbf{\Sigma}_{-}.\tag{7}\] A nonlinear probe still recovers concept information from variance asymmetry along axes where \(\mathbf{\Sigma}_{+}\) and \(\mathbf{\Sigma}_{-}\) differ. We append a rank-\(2\) projection: the top-\(2\) eigenvectors of \(\Delta\mathbf{\Sigma}\) ranked by \(|\lambda|\), orthonormalized with a residual mean direction via QR, \[\label{eq:covmatch95basis} \mathbf{D} = \mathrm{QR}\!\left([\,\hat{\mathbf{d}}_{\text{mean}} \;\big|\; \mathbf{e}_1, \mathbf{e}_2\,]\right) \in \mathbb{R}^{d \times 3},\tag{8}\] \[\label{eq:covmatch95apply} \tilde{\mathbf{x}} = \mathbf{x} - \mathbf{D}\mathbf{D}^\top \mathbf{x}.\tag{9}\] Because LEACE has aligned class means, \(\hat{\mathbf{d}}_{\text{mean}} \approx \mathbf{0}\) and the effective rank removed is two. This is a special case of the \(k\)-LEACE framework of [11] restricted to second-order eigenvectors, which are stable to estimate from \(n \approx 7000\) examples while higher-order tensors are not. We keep the top two eigenvectors across all 119 settings: for a binary concept, these directions capture the two axes of class-conditional variance asymmetry; subsequent eigenvectors describe noise rather than class-discriminative signal. Empirically, keeping three or more eigenvectors adds no leakage reduction and begins to erode control accuracy (see Tab. 4).

The two stages erase structurally distinct signal (mean shift vs.variance asymmetry) and together remove an effective rank of at most \(3\), negligible relative to the representation dimension \(d\) across our settings (\(d = 768\) for the CLIP ViT-B/32 image embedding, and \(d \in [896, 5376]\) across the 13 LLM hidden sizes), exposing the residual nonlinear structure that the manifold-constrained loop attacks.

9 Closed-form preprocessing ablation↩︎

Tab. 3 reports a new nonlinear probe (\(h{=}128\), 200 SGD steps, patience 3) trained on three representation states per setting: clean, post-LEACE, post-(LEACE + CovMatch). Sycophancy is fully exhausted by closed-form preprocessing (mean NL \(0.563\) indistinguishable from floor \(0.560\) and from MANCE⁺⁺’s \(0.560\)). Gender is not: LEACE + CovMatch leaves \(14.8\)pp residual above floor that the manifold-constrained loop closes to \(1.0\)pp. Safety follows the gender pattern with \(11.5 \to 0.2\)pp.

10 NLP full per-setting breakdown↩︎

Table 4 reports the per-setting version of the main-text Tab. 2, restricted to the 7 method columns shared with the main-text breakdown (the pure MANCE and MANCE⁺ ablation rows of the main-text table are not repeated per-setting). For each of the 39 NLP settings and each of the four surgicality budgets, the signed deviation \(D_S\) in pp is measured at the in-budget trajectory step with smallest \(|D_S|\). Bold marks the row-best per setting per budget block (every method within numeric precision of the row-best is bolded). The trailing row reports the per-method mean across the 39 settings.

2.2pt

11 CelebA full per-attribute breakdown↩︎

Tab. 5 is the full per-method \(\times\) per-budget summary across both surgicality regimes summarized in §5.0.0.3. Cells report signed mean \(D_S\) in pp at the in-budget trajectory step with smallest \(|D_S|\), plus coverage (§4.1) and at-chance count.

4pt

Fig. 8 reports the per-attribute nonlinear-probe accuracy \(S\) for each of the 40 CelebA attributes at all four surgicality budgets, in the same bar-chart style as the NLP per-model figures (App. Figs. 5–7): three bars per attribute (Clean / MANCE⁺⁺ / Obliviator) and a horizontal tick at the per-attribute majority-class floor. Hatched bars annotated “N/A” indicate that the method had no in-budget step at the shown \(D_Y\) budget; we substitute its clean (un-erased) \(S\) so the visual height communicates “no valid in-budget point” rather than a real measurement. A clear win for MANCE⁺⁺ reads as a low solid blue bar paired with a high (often hatched-N/A) orange Obliviator bar, common at \(D_Y \le 1\)pp in the most-correlated regime, where Obliviator overshoots the budget on \(38\) of \(40\) high-correlation targets while MANCE⁺⁺ keeps \(19\) in budget and drives \(15\) of them to floor.

Tabs. 6–8 report the per-attribute numerical version of App. Tab. 5, one table per surgicality budget \(D_Y \in \{1, 3, 5\}\)pp: signed \(D_S\) in pp at the in-budget trajectory step with smallest \(|D_S|\). Bold marks the row-best per regime block. The trailing row reports the per-regime per-method mean. The tightest budget (\(\le 1\)pp) is where the gap between MANCE⁺⁺ and the baselines is largest; it is also where Obliviator overshoots most often and shows “–” on the hardest entangled targets.

2.2pt

2.2pt

2.2pt

12 Hyperparameters↩︎

The per-sample local-radius-capped \(\lambda_i\) (Eq. 6 ) eliminates the global \(\lambda\) from the proposed method. We fix the remaining step-controlling hyperparameters across all 119 settings (39 NLP \(\times\) 80 CelebA) with no per-setting tuning. Values and the appendix sections that justify them:

Every method in Tab. 2 runs at these fixed values.

12.0.0.1 Local-basis rank \(r\) and the floor \(k_{\min} = 8\).

The rank \(r\) of the local tangent basis is set from the intrinsic dimension of the clean representations \(\mathbf{X}^{(0)}\), estimated once with TwoNN [24] and kept fixed throughout the iterative loop: \[r = \max\bigl(k_{\min},\; \lceil \mathrm{TwoNN}(\mathbf{X}^{(0)}) \rceil\bigr), \qquad k_{\min} = 8.\] We use TwoNN as a data-driven default for the rank so that the basis is wide enough to capture the local variance of nearby representations but not so wide that it absorbs noise directions, both of which would degrade the spectrally-weighted direction in Eq. 2 . The floor of \(8\) is a guard against pathological TwoNN outputs: on small or noisy representation pools the estimator can collapse to single-digit values (sometimes \(1\)–\(3\)), at which point a rank-\(r\) basis is too short for the local singular spectrum to support a meaningful \(\sigma\)-weighting. The floor sets a conservative minimum that prevents this collapse without interfering with reasonable estimates; on our 119 settings TwoNN typically returns values well above \(8\), so the floor does not bind in practice.

13 Computational cost↩︎

10 reports the wall-clock cost of fitting and applying each method on a representative NLP panel (Qwen2.5-1.5B, gender, layer 14), using each method’s canonical configuration from 2. All nine methods are timed sequentially in a single job on one NVIDIA B200 GPU with 8 CPU cores. We time only the fit-and-apply path: diagnostic probes used solely to log the \(S\)/\(Y\) trajectories are excluded, while probes internal to a method’s own stopping rule (INLP’s convergence check, MANCE’s scorer margin) are included.

MANCE is the most expensive method, at roughly eight minutes per panel (\(458.8\)–\(474.9\) s across the three variants): each round re-estimates a local tangent basis per row (kNN against the fixed natural reference \(\mathbf{X}^{(0)}\), then a batched SVD), and periodically refits the nonlinear scorer. The closed-form preprocessing in MANCE⁺ and MANCE⁺⁺ adds only a few seconds on top of the loop (\(458.8 \to 470.5 \to 474.9\) s). The baselines are far cheaper: LEACE and CovMatch are one-shot at a few seconds (\(3.7\) and \(7.3\) s); the boundary and gradient erasers Obliviator, IGBP, and AmbCE⁺⁺ run in \(20\)–\(24\) s; and INLP takes \(286.9\) s, dominated by its CPU-bound per-round logistic-regression fits. This is a one-time, per-panel offline cost and does not affect inference: every method outputs an edited representation set, or an affine map for the closed-form erasers.

14 Why \(\varepsilon = 0.1\) transfers across panels↩︎

Section 3.2.0.5 chooses the per-sample step size \(\lambda_i\) so that the displacement magnitude satisfies \(\|\tilde{\mathbf{x}}_i - \mathbf{x}_i\|_2 \le \varepsilon \cdot r_i\), where \(r_i\) is the mean Euclidean distance from \(\mathbf{x}_i\) to its \(k\) nearest neighbors among the natural representations \(\mathbf{X}^{(0)}\) (Eq. 5 ). This appendix explains why a single value \(\varepsilon = 0.1\) can be used across all 39 NLP settings (13 language models \(\times\) 3 concepts at 50%-depth) and all 80 CelebA settings (40 attributes \(\times\) 2 surgicality regimes) without per-setting tuning of the local-radius cap.

14.0.0.1 Reading the constraint.

With \(\|\tilde{\mathbf{x}}_i - \mathbf{x}_i\|_2 \le \varepsilon \cdot r_i\), the budget reads “the displacement L2 norm is at most \(\varepsilon\) fraction of the local Euclidean neighborhood radius.” The local radius \(r_i\) is recomputed every round: the neighbors are drawn from the fixed natural representations \(\mathbf{X}^{(0)}\) but measured from the sample’s current (edited) position \(\mathbf{x}_i^{(t-1)}\), so as a point moves under earlier edits its distance to the surrounding natural neighborhood (and hence the budget) tracks the new location. The same \(\varepsilon\) corresponds to a small move when the neighborhood is dense (small \(r_i\)) and a larger move when the neighborhood is sparse (large \(r_i\)), which is the behavior we want from a local first-order step.

14.0.0.2 Why \(\varepsilon\) is setting-independent.

A single global step size \(\lambda\) has setting-specific units: applied verbatim to a Gemma-3-27B representation with \(d=5376\) it moves the point by a much larger Euclidean distance than the same constant applied to a Qwen2.5-0.5B representation with \(d=896\). The local \(r_i\) used here is computed from each panel’s own representations, so the displacement magnitude \(\varepsilon \cdot r_i\) is automatically expressed in the panel’s representation scale. The ratio of the displacement to the local neighborhood radius is the same across panels for a fixed \(\varepsilon\), even though the absolute Euclidean distance moved is very different. This is the property that makes \(\varepsilon = 0.1\) behave consistently across the 119 settings.

14.0.0.3 Per-row, not just per-panel.

Because \(r_i\) is computed at the level of each individual sample, the budget also adapts within a panel. Rows that lie in dense regions (where neighbors are close) get small allowed displacements; rows in sparse regions get larger ones. This is what distinguishes the per-row \(\lambda_i\) in Eq. 6 from a global \(\lambda\): a global step size has to be small enough not to over-edit the densest rows, which leaves the sparse rows under-edited. The per-row local-radius cap addresses both at once.

15 CelebA control-set construction (least- vs.most-correlated five attributes)↩︎

For each of the 40 binary CelebA attributes used as a target concept, we report two complementary surgicality regimes (Section 5.0.0.3, Tabs. 6–8, Figure 8): the 5 least-correlated attributes and the 5 most-correlated attributes, both selected from the remaining 39 attributes. This appendix records exactly how the two control sets are computed.

15.0.0.1 Computation.

Let \(\mathbf{Y} \in \{0, 1\}^{N_{\text{train}} \times 40}\) be the train-split label matrix, with \(\mathbf{Y}_{i,k}\) the label of training example \(i\) on attribute \(k\). We compute the empirical Pearson correlation matrix \[\mathbf{R}_{k\ell} \;=\; \frac{\mathrm{Cov}(\mathbf{Y}_{:,k}, \mathbf{Y}_{:,\ell})}{\sqrt{\mathrm{Var}(\mathbf{Y}_{:,k}) \cdot \mathrm{Var}(\mathbf{Y}_{:,\ell})}} \quad \text{for } k, \ell \in \{1, \ldots, 40\}.\] For each target attribute \(k\), we then rank the remaining \(39\) attributes by absolute correlation \(|\mathbf{R}_{k\ell}|\):

• the 5 least-correlated controls are the bottom 5 by \(|\mathbf{R}_{k\ell}|\). They share minimal information with the target and isolate clean surgicality.

• the 5 most-correlated controls are the top 5 by \(|\mathbf{R}_{k\ell}|\). They share substantial information with the target and form a stricter test of whether erasure can preserve genuinely related downstream features.

The target attribute itself is excluded from the candidate pool (i.e., \(\ell \neq k\)). Pairs are computed in float64 with no shrinkage.

15.0.0.2 Concrete examples.

For Male, the 5 most-correlated attributes are Wearing_Lipstick (\(|r| \approx 0.78\)), No_Beard, Heavy_Makeup, Attractive, and 5_o_Clock_Shadow; the 5 least-correlated are Narrow_Eyes, Blurry, Straight_Hair, Receding_Hairline, and Pale_Skin (all \(|r| < 0.05\)). Erasing Male while preserving the most-correlated controls is genuinely hard because the controls are partial proxies for the target; erasing while preserving the least-correlated controls tests whether the intervention is geographically narrow but not whether it disentangles correlated information. We therefore report both regimes side by side: each one isolates a different failure mode.

15.0.0.3 Full per-target listing.

Tabs. 11–12 list the two control sets for every one of the 40 target attributes, each with its absolute Pearson \(|r|\) on the train split.

2.5pt

2.5pt

15.0.0.4 Why two regimes per concept.

Reporting only one control set hides whichever regime the method happens to be weak in. A method that destroys the entire representation will pass the least-correlated test (controls are essentially independent of the edit anyway) and fail the most-correlated test catastrophically; conversely, a method that performs no erasure will pass both. The difference between the two regimes per method is therefore informative even when both individual numbers look acceptable. Section 5.0.0.3 reads the difference as a measure of how much an erasure method confuses “avoid this concept” with “avoid everything correlated with it”.

16 Closed-form per-row \(\lambda_i\) statistics↩︎

For each setting and each outer iteration of the proposed method (the manifold-constrained loop with fixed local-radius fraction \(\varepsilon = 0.1\)), the closed-form rule of Eq. 6 produces a per-row step magnitude \(\lambda_i\) (capped at \(\lambda_{\max} = 64\)). Table 13 reports the distribution of these per-row \(\lambda_i\) averaged across all 60 iterations of each trajectory and then aggregated across settings.

The mean across the entire grid, \(\bar{\lambda} \approx 29.31\), is the value at which AmbCE⁺⁺ appears in Tab. 2: forcing the unconstrained full-space method to take the same effective step magnitude that the closed-form per-row rule produces under MANCE⁺⁺ isolates the gradient-direction constraint (tangent-projected vs.full-space) as the only remaining axis of variation between the two methods.

17 Empirical support for the manifold premise↩︎

The geometric premise used by MCH (3.1) states that natural representations concentrate on a low-dimensional manifold. We check this directly, independent of any erasure result. Tab. 14 reports the local intrinsic dimension (TwoNN, [24]) and the mean angle between a single global concept direction and the local per-sample concept directions, for the primary nonlinear case (sycophancy) and the diagnostic linear baseline (gender). For sycophancy the intrinsic dimension is \(34\)–\(53\), far below the dimension \(d \in [768, 5376]\) of the Euclidean representation space, and the large local/global angles show that a single global direction is a poor first-order summary across neighborhoods, both consistent with concentration on a curved, low-dimensional structure rather than a global linear subspace.

18 Anisotropy regimes for the local-\(\sigma\) spectrum↩︎

18.0.0.1 Where \(\boldsymbol{\sigma}\) enters the update.

The spectral exponent \(\alpha\) controls how the singular values of the mean-centered local PCA matrix \(\mathbf{S}_i\) enter the tangent direction \(\mathbf{d}_i\) (Eq. 2 ): the tangent coordinate of \(\mathbf{u}_i\) along \(\mathbf{v}_i^{(\ell)}\) is reweighted by \(\sigma_{i,\ell}^{\alpha}\) before re-assembly in the Euclidean representation space. The local-radius budget itself (Eq. 6 ) is direction-agnostic; it is a fraction of the local Euclidean neighborhood radius \(r_i\). So \(\alpha\) is what makes the update direction-aware in the local spectrum; the budget is what makes the update magnitude scale-aware in the local representation geometry.

Eq. 2 reweights each tangent coordinate \(a_{i,k}\) by \(\sigma_{i,k}^{\alpha}\), where \(\alpha \in \mathbb{R}\) is an anisotropy exponent and \(\sigma_{i,k}\) are the singular values of the mean-centered local PCA matrix \(\mathbf{S}_i\) (Eq. 1 ). Three non-negative values of \(\alpha\) have natural interpretations:

• \(\alpha = 0\): the tangent direction \(\mathbf{d}_i = \mathbf{B}_i \mathbf{c}_i\) is the bare projection of the unit gradient onto the local tangent basis; the singular spectrum plays no role in shaping the direction.

• \(\alpha = 1\): each tangent direction is reweighted by \(\sigma_{i,k}\). This is the default in this paper. It uses the local PCA spectrum directly: high-\(\sigma\) tangent axes receive more step mass, while thin axes receive less.

• \(\alpha = 2\): each tangent direction is reweighted by \(\sigma_{i,k}^2\). This is a stronger SVD-spectrum weighting with a Mahalanobis-style intuition, but it is not derived by solving a covariance-constrained optimization: we do not form or invert a local covariance matrix. Geometrically, it suppresses low-variance tangent directions most strongly, which may also suppress residual concept information carried by thin directions.

18.0.0.2 Mahalanobis-style intuition (and what \(\alpha = 1\) is not).

A reader familiar with Mahalanobis whitening might wonder whether our \(\alpha = 1\) is the same operation. It is not. Classical Mahalanobis whitening explicitly uses a covariance inverse square root, \(\mathbf{x}^{\mathrm{white}} = \mathbf{C}^{-1/2} \mathbf{x}\); in the local-PCA coordinates this corresponds to scaling each tangent direction by \(\sigma_{i,k}^{-1}\), i.e.\(\alpha = -1\) in our notation. Whitening makes every direction equal-weighted, which would dilute the concept-specific signal we want to suppress and force every tangent axis to receive equal step magnitude.

We use a positive power, \(\sigma_{i,k}^{+1}\), which does the opposite: it reweights the tangent step toward high-\(\sigma\) principal axes (the directions where the local manifold has the most support and where the linear approximation is most reliable) and away from low-\(\sigma\) thin tail directions where the linear approximation is less reliable and motion most easily leaves the manifold. The three non-negative values \(\alpha \in \{0, 1, 2\}\) form a one-parameter family interpolating between (i) treating every tangent direction as equally reliable (\(\alpha = 0\), isotropic), (ii) reweighting by \(\sigma_{i,k}\) to respect the local ellipsoid mildly (\(\alpha = 1\), our default), and (iii) a stronger spectral weighting that follows the local ellipsoid more aggressively and suppresses thin directions most (\(\alpha = 2\)). Whitening (\(\alpha = -1\)) sits outside this range for our problem because its sign is opposite the geometric correction we want; we therefore do not include it.

References↩︎

---

1. Code is available at: https://github.com/MatanAvitan/mance↩︎

2. Multiclass targets can be handled by fitting one-vs-rest probes for the class to erase.↩︎

3. Unless otherwise specified, the new probe is a 2-layer MLP with hidden size \(h=128\), trained for 200 SGD steps with patience 3.↩︎