Concept Erasure with LEACE Explained: How It Works

Concept erasure with LEACE means editing a model's internal vectors so that no linear classifier can read a chosen concept, such as gender or part of speech, while moving the vectors as little as possible. LEACE stands for LEAst-squares Concept Erasure. Nora Belrose and five coauthors introduced it at NeurIPS 2023 as a closed-form method, one formula with no training loop, that "provably prevents all linear classifiers from detecting a concept."

If you want the interpretability background first, Learn AI Alignment Theory has an Advanced course on Interpretability, with short lessons that each list their sources and separate what is known from what is still open.

What concept erasure is for

The paper names two uses. For fairness, you may want a classifier that cannot use gender or race. For interpretability, you may want to remove a concept from a model's activations and see what changes. If behavior shifts, the model was using that concept.

The authors' reasoning is simple: for a model to use a concept, its hidden states must carry information about it. So instead of retraining the model, you edit the hidden states until a family of classifiers can no longer predict the concept better than a constant guess. The paper calls that condition "guardedness." LEACE targets the linear family, the same kind of reader as the linear probes interpretability researchers use to check what a model knows.

The key idea: make the class means equal

The paper proves "a previously unnoticed equivalence": a task is linearly guarded "if and only if every class has exactly the same mean feature vector."

In plain words: a linear classifier can only beat a constant guess if the average vector differs between classes. Make the average for "female" biographies equal the average for "male" ones, and every linear probe is stuck at chance. Leave any gap in the averages, and some linear probe can exploit it.

That turns erasure into a precise problem. Among all edits that equalize the class means, find the one that moves the data least. The authors show there is a unique answer that minimizes the mean squared distance from the original features, for every norm induced by an inner product, including the usual Euclidean one.

How concept erasure with LEACE works in three steps

The paper's Figure 1 shows LEACE as three steps:

1. Whiten. Rescale the data so it has equal variance in every direction and no correlations between features.
2. Project. In that whitened space, remove the directions along which the features covary with the concept label. This is what guarantees linear guardedness.
3. Unwhiten. Map back so the data's covariance looks like the original again.

Everything comes from means and covariances estimated on your data. The formula is r(x) = x - W+ P W (x - E[X]), where W whitens, W+ undoes it, and P is the projection. The edit is small: with 18 part-of-speech tags in one of the paper's experiments, LEACE cut the rank of BERT's embedding by just 17.

The authors' code is a Python package, concept-erasure. Its README shows the short path: LeaceEraser.fit(X, Z) on feature vectors X and concept labels Z, then apply the eraser to X.

A worked example with two features

This toy case is our own arithmetic, not from the paper. It assumes two features that are uncorrelated, so whitening does not rotate anything.

• Group A has mean (2, 1). Group B has mean (0, 1). The groups are the same size, so the overall mean is (1, 1).
• The groups differ only on the first feature. That is the concept direction.
• LEACE removes the part of each point that lies along that direction, measured from the overall mean. So a point at (2.3, 0.7) becomes (1, 0.7), and a point at (-0.4, 1.5) becomes (1, 1.5).
• Now both groups have mean (1, 1). By the paper's equivalence, no linear classifier can tell them apart better than chance.
• The second feature is untouched, because it carried nothing about the group.

Real activations have correlated features, which is why the whitening step matters: without it, the smallest edit would not be the one that projects straight down an axis.

What the paper found

Gender bias in BERT. The authors embedded short biographies, labelled with gender and profession, using BERT's [CLS] vector, then erased gender. Logistic regression could no longer predict gender above random, and LEACE was the only method compared that reached that with a small edit; it also ran "around 2 orders of magnitude faster" than RLACE, a gradient-based rival. A profession classifier on the erased vectors scored 77.3%, against 79.3% before. The gap in true positive rates between genders fell from 0.198 to 0.084. Refitting the classifier on the erased vectors gave 78.1% accuracy, but the gap rose again to 0.158.

Concept scrubbing. Erasing at one layer changes every later layer, so the authors fit LEACE layer by layer in order, scrubbing each layer before fitting the next. They removed part-of-speech information from every layer of four Pythia and three LLaMA models.

Table 1 of the LEACE paper, redrawn.

Random erasure barely moved performance; erasing part of speech raised it sharply in every model. The authors read this as "strong evidence that autoregressive language models heavily rely on linearly encoded part-of-speech information." An older method, SAL, raised it further, which they take as more collateral damage: "If this experiment were conducted with SAL alone, we would have overestimated the causal effect of part-of-speech." That is the same concern behind careful causal tests such as activation patching.

Limits the authors state

• Linear only. The guarantee covers linear classifiers. The authors "conjecture that it is intractable" to edit data so no general nonlinear adversary can recover the concept, unless the data generating process is known in detail.
• Training could route around it. If scrubbing were built into training, "it remains to be seen" whether optimizers would encode the attribute in "completely nonlinear ways."
• More validation needed. They want experiments on concepts much narrower than part of speech, with behavioral checks that scrubbing changes the network the way we would expect.
• Your data, your statistics. The means and covariances come from the data you fit on, so the guarantee is about that distribution.

LEACE belongs to a family of methods that act on directions in activation space, alongside the refusal direction, activation steering and representation engineering.

Frequently asked questions

What does LEACE stand for?

LEAst-squares Concept Erasure. "Least squares" refers to the edit being the smallest in mean squared distance among those that make the concept linearly unreadable.

How is LEACE different from INLP?

INLP (iterative nullspace projection) removes one probe's direction at a time. In the paper's BERT replication it needed 20 rounds, removed 360 dimensions and still left the concept above majority accuracy; LEACE removed 17 in one step.

Does LEACE remove a concept from a model completely?

No. It removes what linear classifiers can read, on the data it was fit to. Nonlinear readers may still recover the concept.

Does erasing a concept hurt the model?

It depends on whether the model uses it. Erasing gender barely changed profession accuracy, while erasing part of speech raised language models' loss sharply.

Get started

Concept erasure is one tool in the wider interpretability toolkit. Learn AI Alignment Theory's Advanced course on Interpretability sits beside Scalable Oversight and The Science of LLM Misalignment, every lesson lists its sources, and debate cards set out each serious position with no verdict. You sign in with Google or an emailed code. Read more on the About page.

Start Learn AI Alignment Theory: short hands-on lessons from first principles to open research, with every side of every debate and the sources to read next.