A representation carries a concept along one direction. Delete that direction — project every vector onto the orthogonal complement — and no linear probe can read the concept back, while every other coordinate is left untouched. This is the idea under INLP and LEACE: guard a trait by nulling it out, changing the representation as little as possible. Down the center: representations go in, the projector erases, the proof comes out. Blue builds it; red breaks it.
source Ravfogel, Elazar, Gonen, Twiton, Goldberg, Null It Out: Guarding Protected Attributes by Iterative Nullspace Projection (2020) — arxiv.org/abs/2004.07667; Belrose et al., LEACE: Perfect linear concept erasure in closed form (2023) — arxiv.org/abs/2306.03819. Rendered, not quoted.
The concept lives along a known unit direction ĉ. Erasure is one orthogonal projector:
P = I − ĉ ĉ⊤
P kills the concept axis and fixes everything perpendicular to it. Two facts define it, checked live:
| property | value |
|---|
Rank d−1, symmetric, P²=P: a rank-one deletion, not a rewrite.
The probing classifier reads a feature off a representation by finding the direction that separates it. Run that in reverse: find the direction, then remove it — now the probe reads nothing.
Erasure is the probe run backwards. It is the linear tool under concept scrubbing and trait unlearning: the next sphere asks whether the concept truly left, or only went nonlinear.
The blue team re-checks the erasure guarantee on every interaction: probe at chance, orthogonal coords preserved, bystander concept intact, projection idempotent. If red swaps the direction, this badge is where it shows.
A constructed model, so every readout has a closed form. Twenty vectors in R⁴, built by hand on an orthonormal frame:
ĉ = ½[1,1,1,1] carries concept A · v̂ carries an orthogonal concept B (the bystander) · two more axes carry content. Each vector: x = a·yA·ĉ + b·zB·v̂ + content, labels yA,zB ∈ {+1,−1} balanced.
Because A sits on ĉ and B sits perpendicular to it, projecting ĉ away must erase A exactly and leave B whole — that is the claim the panel proves.
Concept A rides ĉ. Apply P and its linear probe collapses to chance — the concept is unreadable, and B is untouched.
| probe accuracy | before P | after P |
|---|---|---|
| concept A |
A sample of the vectors — x, its erased image Px, and the removed part x−Px (parallel to ĉ only):
| x | Px | x − Px |
|---|
Every number is computed on the spot from P and the mean-difference probe — none is looked up.
What the machine produces, proven on the constructed model: concept A probe falls from 100% to 50% chance (linearly unreadable); every coordinate orthogonal to ĉ preserved to 1e−9 (change is minimal, along ĉ alone); concept B still read at 100% (specific); and P²=P (idempotent).
The witness (left) re-derives these live; the red team (right) tries to make the erasure a lie.
And the guarantee is fragile in time: fine-tune the model and the concept can be re-learned into a fresh direction the projector never touched. “Unreadable” is always scoped to the probe family and the frozen weights you tested — never a claim that the trait is gone.
“Erasing the direction removes the concept from the model.” Cut. It removes linear readability; nonlinear probes and later layers can re-extract correlated signal. INLP/LEACE guard, they do not delete.
“INLP removes exactly the concept and nothing else.” Corrected. Iterated null-space projection can strip more than needed and scar the representation. LEACE (2023) is the least-squares-optimal minimal erasure — the single projection this panel computes.
“A probe at chance means the concept is gone.” Cut. Chance for this probe, on this split. More capacity, or a different layer, may still read it. Chance = linearly unreadable here, not absent.
The red team’s move: project out a random direction instead of the concept’s, then call it erased. The concept still rides ĉ, untouched — so its probe never drops to chance. The witness (window 7) recomputes and catches it.
Swap ĉ for a random unit vector ĝ. Concept A survives the wrong projection, its probe stays near 100%, the witness disagrees with the known guarantee and turns red. Nothing is faked; the attack is real and it is caught.