LEACE: Perfect linear concept erasure in closed form

Concept erasure aims to remove specified features from an embedding. It can improve fairness (e.g. preventing a classifier from using gender or race) and interpretability (e.g. removing a concept to observe changes in model behavior). We introduce LEAst-squares Concept Erasure (LEACE), a closed-form method which provably prevents all linear classifiers from detecting a concept while changing the embedding as little as possible, as measured by a broad class of norms. We apply LEACE to large language models with a novel procedure called "concept scrubbing," which erases target concept information from every layer in the network. We demonstrate our method on two tasks: measuring the reliance of language models on part-of-speech information, and reducing gender bias in BERT embeddings. Code is available at https://github.com/EleutherAI/concept-erasure.

Paper

Similar papers

Peer review

Reviewer uqXm4/10 · confidence 4/52023-06-25

Summary

The paper presents a concept erasure procedure that also takes into account the distortion of the representations during the debiasing process. To this end, the paper builds on several works on iterative nullspace projection approaches and incorporates a regularization component. First, LEACE improves upon previous projection approaches by showing that E[X|Z]=E[X] is sufficient to protect information against a linear adversary. Using this result, the paper presents a closed-form solution for the objective function. The paper shows experiments on debiasing and interoperability setups. The results showcase that LEACE can achieve similar levels of debiasing performance with the learned representations having much less distortion (measured in terms of its rank).

Strengths

Strengths: 1. The paper proves the interesting result that achieving the following condition: E[X|Z]=E[X] results in preventing any linear adversary from extracting information about the protected attribute from a representation set. 2. The paper presents a closed-form optimal solution to linear debiasing with the L2 regularization constraint. 3. The paper shows experiments in several debiasing and interpretability setups. The results show that LEACE is able to achieve debiasing performance at par with previous approaches while retaining significant information (in terms of rank).

Weaknesses

Weakness: 1. Is it unclear from the paper why the MSE reconstruction loss E[X-\hat{X}] is a good measure of information being retained? Ideally, I believe that the goal of concept erasure is to retain within-class information for each of the protected class categories. For such a requirement, there can be a trivial baseline where E[X|Z]=E[X] is achieved by normalizing the data within each class to have the same mean. Does this baseline work at all in terms of debiasing? If yes, what are the advantages of LEACE over this baseline? If no, is E[X|Z]=E[X] the right condition to be achieved? 2. The derived closed-form result looks very similar to the result in RLACE. It would be interesting to have an analytical discussion about the differences and their implications on debiasing performance. 3. Although having minimal edits is one of the key focuses of this paper, reconstruction loss is not reported in the results section. Simply reporting the rank is not convincing enough to evaluate the efficacy of the proposed approach in the paper. How does the reconstruction loss compare with other linear debiasing methods? If rank is the right metric to look at instead of the MSE loss, the paper needs more justification about why that is the case. 4. The fair representation learning framework proposed in this paper has been studied by various works previously. For example, LAFTR[1] and [2] have a similar reconstruction loss along with a classifier and adversary. The paper should have these baselines by simply removing the classifier component and having just the reconstruction and a linear adversary loss. This would be useful in understanding the efficacy of projection-based approaches over adversarial ones. 5. The experimental section is fairly weak at the moment. For example, in Table 1, why is LEACE not compared with RLACE and INLP in this setup? The authors do not report the performance of word embedding debiasing, which is one of the most common benchmarks for evaluating concept erasure approaches. 6. The organization/writing of the paper can be improved in several areas. Broadly, some of the theoretical results can be condensed and more context about the debiasing setup would be helpful for readers not too familiar with concept erasure literature. See some minor additional comments in the suggestions/limitations section. [1] https://arxiv.org/pdf/1802.06309.pdf [2] https://www.cs.toronto.edu/~toni/Papers/icml-final.pdf

Questions

See the weakness section.

Rating

4: Borderline reject: Technically solid paper where reasons to reject, e.g., limited evaluation, outweigh reasons to accept, e.g., good evaluation. Please use sparingly.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

2 fair

Contribution

3 good

Limitations

Line 45: “taking values in Rd”: what do values refer to here? I get that it refers to X but should be clearly stated. Line 53: could not find the 4th variable defined in Section 2.1. Is it referring to the loss function? Line 55: it's unclear why the family of loss functions needs to be used here. The guarding is defined w.r.t. to a single loss function. The framing of different lemmas can be smoothened out to make it more straightforward. More context about the functioning of the baseline approaches would be helpful.

Reviewer 3Jip7/10 · confidence 5/52023-07-06

Summary

This paper introduces a novel method to guard pretrained representations of deep neural networks from linear recovery of sensitive attributes Z. The notion of linear guardedness comes from the previous literature, while this paper proposes a simple characterisation when it takes place, which allows to dramatically simplify the algorithm as well as improve the performance. Unlike the previous methods such as INLP, the LEACE projection matrix has rank d - k, where d is the dimension of the representation at hand, and k is the number of values Z can take (i.e. 2 in the binary case). This allows to guard the sensitive attribute with minimal losses. The authors confirm this with two experiments: 1) guarding gender in bios from De-Arteaga et al. 2) amnesic probing from Elazar et al. pros: - simple and effective method that outperforms previous literature - well written, and the equivalence theorems are easy to follow - the experiment in Figure 3 is fascinating, in particular, the conclusion that the information is concentrated in layer 11 cons: - lack of error bars. For example, in the experiment corresponding to Figure 1, what happens if we feed a limited data into the LEACE algorithm and test guardedness on the rest? - in the experiments the data to which LEACE is applied is the same as it is tested on. It is not tested whether the concept can be erased using dataset that is collected independent of the downstream task. - the conclusion in section 5.3 is relevant to interpretation methods such as Kim et al "Interpretability beyond attribution: TCAV", who are also concerned with what kinds of information a neural network extracts at each layer. On the contrary to your claim, they report that the amount of "concept information" does not reduce as data passes from layer to layer, see Figure 5. I wonder how it compares to you measurements in the case of POS concept. Their method is very simple and should be easy to implement. - it is also not entirely clear how it affects the remaining information. For example, if I look at two identical bios which differ only in the gender of a person, how would their representations compare after you have removed the gender concept with LEACE? minor comments: - Figure 3: ramdom - l306: which a we

Strengths

-

Weaknesses

-

Questions

-

Rating

7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.

Confidence

5: You are absolutely certain about your assessment. You are very familiar with the related work and checked the math/other details carefully.

Soundness

3 good

Presentation

4 excellent

Contribution

3 good

Limitations

-

Reviewer EBcB7/10 · confidence 3/52023-07-11

Summary

Suppose we are given a distribution of data points $(x,z)$, where $x \in \mathbb{R}^d$ and we have one-hot class labels $z \in \mathbb{R}^k$. This paper shows how to construct an affine transformation $\phi(x) = Px + b$ of the data so that * $\phi(x)$ has zero covariance with $z$ * $\\|\phi(x) - x\\|$ is minimized, subject to the above condition The paper argues that this is the optimal affine transformation that ``erases'' the concept $z$ from the representation $x$. Namely, linear regression on $x$ with any convex loss function will be unable to reconstruct $z$ better than random guessing. The paper empirically shows that the proposed method outperforms previous methods (RLACE, INLP) for erasing concepts from a representation, in terms of computational efficiency/collateral damage of the concept erasure. Applications are demonstrated in: 1) fairness, and 2) probing language models to measure how much a certain concept matters to their performance.

Strengths

The paper has excellent exposition: the proofs and definitions are clear and simple to follow, and the experiments are generally well explained. The applications to language models are compelling, and the paper demonstrates an improvement over previous approaches. The result is of broad interest to the community.

Weaknesses

I am not an expert in the field of concept erasure, so I do not know if this method was previously known. However, my feeling is that the paper proposes a "trivial" solution: orthogonal projection of the random vector $x$ to the subspace of random vectors uncorrelated with $z$. So I find it surprising that this method was not previously known (maybe in a different field and under a different name). Of course, this is not actually a weakness of the paper (but rather of the reviewer).

Questions

1. The authors state that "prior work has focused solely on preventing linear models from leveraging Z", whereas their work applies also to deep neural networks. How does this claim relate to the cited papers [22, 5, 3, 37], which also intervene on the representations of deep neural networks? 2. Can the authors clarify the paragraph at the top of page 7, entitled "Results"? Why is 77.3% profession-prediction accuracy reported, and then 78.1% accuracy reported? What is the difference between these settings? Typos: * In Definition 2.1, \mathfrak{L} is said to have been defined in Section 2.1, but it is not. * In Section 2.2, the equation between lines 56 and 57 is an argmax over X' but X' does not appear in the expression * Figure 3, "ramdom" -> "random" * Appendix E.1, "a forteriori" --> "a fortiori"

Rating

7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.

Confidence

3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

4 excellent

Presentation

4 excellent

Contribution

3 good

Limitations

Yes

Reviewer rafU6/10 · confidence 3/52023-07-27

Summary

This paper studies concept removal from features. For linear classifiers, the authors prove several equivalent characterizations of linear guardedness (reducing the accuracy of any linear classifiers to the trivial accuracy). In particular, the features that achieve linear guardedness have zero covariance with the labels. Equipped with the new characterizations on the linear guardedness, the authors propose a new formulation of concept removal. Specially, the formulation finds the linear map minimizing the Euclidean distance such that the features after the linear transformation are linearly guarded. The formulation yields a quadratic program with a single linear equality constraint, and thus enjoys a closed-form solution. The author conducts three experiments to verify the effectiveness of the method. The experiments on removing gender information from BERT shows that the proposed method successfully removes gender bias while preserving the classification accuracy. They also apply the proposed method removing part-of-speech tag information from language models to investigate the importance of POS tag on language modeling tasks.

Strengths

The idea of minimizing the Euclidean distance seems natural. The characterization on the linear guardedness is sound and useful. Importantly, this paper reveals connections with previously published methods and thus may strengthen the understanding of concept erasure. For example, the theoretical characterization justifies that SAL, Mean Projection and Fair PCA all achieve linear guardedness. Moreover, it is interesting that RLACE has the same top eigenvector with the method proposed in this paper.

Weaknesses

1. The writing overall is good but the structure of writing can be improved. Theorem 4.3 strictly includes Theorem 4.2 as a special case. There is little benefit to separately present Theorem 4.2. Thus, they should be merged. Additionally, I find most of the proofs are not that insightful and thus it's better to defer them to the appendix. The extra space can be used to expand the preliminaries section as I find the current presentation is not entirely clear for audience who's not familiar with the topic. 2. One experiment that I am curious about is the part-of-speech tag prediction accuracy after concept scrubbing. As LEACE only guarantees linear guardedness, it is unclear from Section 5 and 6 whether non-linear classifiers still preserves the concept after concept scrubbing. Minor: - Line 325: lineally -> linearly

Questions

1. In Figure 1 left, why does random projection have even higher accuracy compared to no intervention? I would expect random projection to be the same or slightly worse than no intervention. Figure 1 right does show they have similar loss. 2. The definition 2.1 might have an issue. The maximization right after Line 56 should be over all possible joint distributions over features and labels that has marginal distribution the same as $Z$.

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

This authors have listed their limitations in the paper which have been addressed.

Reviewer EBcB2023-08-14

Response

Thank you for the clarifications. I am happy to keep my score of Accept, and would like to congratulate the authors on the excellent work.

Reviewer rafU2023-08-15

Thank you for the response. I suggest the authors incorporate the reviews in the revision.

Authorsrebuttal2023-08-16

Thank you for reading our rebuttal. We would like to draw your attention to the fact that no revisions are allowed until camea-ready stage (https://neurips.cc/Conferences/2023/PaperInformation/NeurIPS-FAQ). We absolutely will (and have already begun to) incorporate the reviews into our draft, and we are excited to share the improved camera ready version with you should our paper be accepted.

Reviewer 3Jip2023-08-15

Thank you for your response. I will keep the score unchanged for now.

Program Chairsdecision2023-09-21

Decision

Accept (poster)

© 2026 NYSGPT2525 LLC