<aside> 임도협 세미나 (260803) </aside>

1. Overview

LEACE, or LEAst-squares Concept Erasure, is a closed-form method for removing a target concept from a learned representation.

Suppose a model produces a representation $X \in \mathbb{R}^d$, and each representation is associated with a concept label $Z \in \mathcal{Z}$.

Examples include:

• $X$: a BERT sentence embedding, $Z$: gender
• $X$: a token-level hidden state, $Z$: part-of-speech tag

The goal is to construct a transformed representation $r(X)$ that satisfies two conditions:

1. No linear predictor can recover $Z$ from $r(X)$.
2. $r(X)$ remains as close as possible to the original representation $X$.

LEACE achieves this without adversarial training or iterative optimization. It computes the erasure transformation directly from means and covariance matrices.

2. Problem Setup

A predictor is written as

$$\eta(\cdot;\theta):\mathbb{R}^d \rightarrow \mathbb{R}^k,$$

where $\theta$ denotes its parameters.

The predictor belongs to a function class

$$\mathcal{V} = {\eta(\cdot;\theta)\mid \theta\in\Theta},$$

and its performance is measured by a loss

$$L:\mathbb{R}^k\times\mathcal{Z}\rightarrow[0,\infty).$$

The best achievable expected loss is

$$\inf_{\theta\in\Theta} \mathbb{E} \left[ L\bigl(\eta(X;\theta),Z\bigr) \right].$$

This quantity represents how well the strongest predictor in $\mathcal V$ can predict $Z$ from $X$.

A representation is called guarded when even the best allowed predictor cannot outperform an input-independent constant predictor.

For linear guardedness, the predictor family consists of affine functions:

$$\eta(x)=b+Wx.$$

3. Key Theoretical Result

The central result of the paper is the following equivalence:

$$X \text{ linearly guards } Z$$

if and only if

$$\mathbb{E}[X\mid Z=j] = \mathbb{E}[X] \qquad \forall j,$$

which is also equivalent to

$$\operatorname{Cov}(X,Z)=0.$$

In other words, a concept is unavailable to every linear predictor exactly when all concept classes have the same mean representation.

This converts concept erasure from an adversarial learning problem into a linear-algebra problem. Instead of repeatedly training classifiers, it is sufficient to eliminate the cross-covariance between $X$ and $Z$.

4. Affine Erasure Condition

LEACE considers affine transformations of the form

$$r(x)=Px+b.$$

The transformed representation linearly guards $Z$ if and only if

$$\operatorname{Cov}(PX+b,Z)=0.$$

Because a constant bias does not affect covariance,

$$\operatorname{Cov}(PX+b,Z) = P\Sigma_{XZ},$$

where

$$\Sigma_{XZ} = \operatorname{Cov}(X,Z).$$

Therefore, the erasure condition is

$$P\Sigma_{XZ}=0.$$

Equivalently, the concept-related subspace must lie inside the nullspace of $P$.

$$\mathrm{colsp}(\Sigma XZ)⊆ \ker(P)$$

5. Least-Squares Objective

Many matrices $P$ satisfy the erasure condition, but some destroy more information than others.

LEACE chooses the feasible transformation that minimizes the expected edit:

$$\min_{P,b} \mathbb{E} \left[ |PX+b-X|_M^2 \right]$$

subject to

$$\operatorname{Cov}(PX+b,Z)=0.$$

Here,

$$|v|_M^2=v^\top Mv,$$

where $M$ is a positive semidefinite matrix defining the geometry of the edit.

The method is optimal not only for ordinary Euclidean distance, but for a broad family of inner-product-induced norms.

6. LEACE Transformation

Let

$$\mu_X=\mathbb{E}[X],$$ $$\Sigma_{XX}=\operatorname{Cov}(X,X),$$

and

$$\Sigma_{XZ}=\operatorname{Cov}(X,Z).$$

Define the whitening operator

$$W= \left(\Sigma_{XX}^{1/2}\right)^+.$$

In the whitened space, the concept-related directions are contained in

$$\operatorname{colsp}(W\Sigma_{XZ}).$$

Let

$$P_{W\Sigma_{XZ}} = (W\Sigma_{XZ})(W\Sigma_{XZ})^+$$

be the orthogonal projector onto that subspace.

The final LEACE transformation is

$$r_{\mathrm{LEACE}}(x) = x- W^+ P_{W\Sigma_{XZ}} W(x-\mu_X).$$

The procedure can be interpreted as:

1. Center the representation.
2. Whiten it.
3. Project it onto the concept-correlated subspace.
4. Unwhiten the projected component.
5. Subtract that component from the original representation.

Thus, LEACE removes the component responsible for the linear predictability of $Z$.

LEACE projection in 3 steps. First the data is whitened, ensuring equal variance in all directions. It is then orthogonally projected onto $\mathrm{colsp}(\mathbf W \mathbf \Sigma_{ X Z})^\perp$, guaranteeing linear guardedness. Finally, we unwhiten the data so that its covariance structure mimics the original.

7. Why the Projection Is Oblique

LEACE is generally not an orthogonal projection in the original representation space.

The constraint

$$P\Sigma_{XZ}=0$$

restricts the nullspace of $P$, not its output range. Therefore, the method is free to choose an output geometry that minimizes distortion.

The resulting matrix is idempotent:

$$P^2=P,$$

but it is generally not symmetric:

$$P^\top\neq P.$$

It is therefore an oblique projection.

This allows LEACE to preserve more of the original data variance than a naive orthogonal projection while still achieving complete linear guardedness.

8. Experimental Results

The paper evaluates LEACE on BERT representations from the Bias in Bios dataset.

After removing gender information:

$$\text{Profession accuracy}: 79.3\% \rightarrow 77.3\%$$

while the gender-related TPR gap decreases from

$$0.198 \rightarrow 0.084$$

This indicates that LEACE substantially reduces gender-associated behavior while preserving most profession-related information.

The paper also reports that LEACE reaches perfect linear erasure with a smaller representation edit than INLP and RLACE, while being roughly two orders of magnitude faster than RLACE.

9. Concept Scrubbing

The paper extends LEACE to deep networks through concept scrubbing.

Instead of erasing a concept from only one layer, concept scrubbing applies LEACE sequentially to every layer.

For each layer $l$:

1. Compute the current hidden states $H_l$.
2. Fit LEACE using $H_l$ and $Z$.
3. Erase the concept from $H_l$.
4. Pass the edited hidden states to the next layer.

This must be done sequentially because an intervention at an early layer changes the hidden-state distribution of all later layers.

When the authors remove part-of-speech information from every layer of LLaMA and Pythia models, language-modeling performance degrades much more than it does under random subspace removal.

The authors interpret this as evidence that these models strongly rely on linearly encoded part-of-speech information.

10. Main Limitation

The phrase “perfect concept erasure” refers only to perfect linear erasure.

LEACE guarantees

$$\operatorname{Cov}(r(X),Z)=0,$$

but it does not guarantee

$$I(r(X);Z)=0.$$

A nonlinear predictor may still recover $Z$ from differences in variance, higher-order moments, or nonlinear geometry.

Therefore,

$$\text{Linear guardedness} \not\Rightarrow \text{complete statistical independence}.$$

---

LEACE removes the concept-correlated component of a representation in whitened space and constructs the least-distorted representation from which no linear predictor can recover the target concept.