ArXiv: 2502.02820

🎯 Pitch

Quadratic concept erasure, intended to make datasets harder, can backfire by injecting higher-order label information that advanced architectures learn to exploit, transforming a supposed difficulty-boosting technique into a data augmentation method that actually improves final performance. Meanwhile, simple linear erasure consistently slows learning across all tested networks, showing that not all statistical sanitization is created equalβ€”and that removing β€œeasy” features can paradoxically make the task easier.

1. Executive Summary

This paper studies whether neural networks can still learn effectively when low-order statistics are surgically removed from image classification datasets, training MLPs, ConvNeXts, and Swin Transformers on CIFAR-10, CIFARNet, and SVHN. The authors derive a novel closed-form QLEACE (Quadratic LEAst-squares Concept Erasure) method that guarantees all classes share both equal means and equal covariance matrices β€” removing all quadratically available information about the label β€” alongside an approximate label-free variant (ALF-QLEACE) that applies the same affine transformation to every datapoint regardless of class. While linear erasure (LEACE) consistently slows learning across all architectures, quadratic erasure produces sharply mixed results: QLEACE can backfire on more expressive architectures like ConvNeXts and Swin Transformers, where models learn to exploit inadvertently injected higher-order Shannon information and ultimately achieve lower loss than on unerased data, while ALF-QLEACE and gradient-based quadratic erasure sometimes act as unintended data augmentation, reducing the minimum description length relative to LEACE β€” establishing that known quadratic concept erasure methods are unreliable and can even accelerate learning on some datasets.

2. Context and Motivation

The Core Problem: Can We Control What Neural Networks Learn by Manipulating Dataset Statistics?

The fundamental question this paper asks is both practically important and theoretically deep: if we surgically remove low-order statistical information from a dataset, can we prevent neural networks from learning to use that information for classification? This matters because neural networks exhibit a well-documented distributional simplicity bias (DSB) β€” they preferentially learn to exploit lower-order statistics of the input data (means, variances, covariances) before discovering higher-order patterns (skewness, kurtosis, and beyond). This bias is not merely an academic curiosity: it shapes what features models rely on in deployment, influences their robustness to distribution shift, and determines whether they can be steered toward or away from using particular kinds of information.

The paper frames its investigation as an inversion of a prior experimental paradigm from Belrose et al. (2024). That earlier work provided evidence for the DSB by training networks on natural data, then evaluating intermediate checkpoints on maximum entropy synthetic datasets whose low-order statistics matched the training distribution but whose higher-order statistics were maximally uninformative. The finding β€” that networks perform well on these synthetic datasets early in training before losing that ability β€” demonstrated that networks indeed learn simple statistics first and only later incorporate more complex patterns.

This paper inverts the question: rather than testing whether networks can use low-order statistics by probing with matched synthetic data, the authors ask what happens when those low-order statistics are made uninformative of the class label from the start. In other words: if you erase all linear (first-order) and quadratic (second-order) information about which class a datapoint belongs to, can a network still learn to classify? And critically: does the answer depend on how you perform that erasure?

This inversion matters because it moves from a descriptive claim ("networks use simple statistics early") to a prescriptive one ("we can control what networks learn by manipulating those statistics"). If the answer were a clean "yes, erasing simple features reliably slows or prevents learning," this would provide a powerful tool for concept erasure in AI safety and fairness applications β€” removing sensitive information like race or gender from representations before downstream use. If the answer is "it depends," as the paper ultimately finds, that reveals fundamental gaps in our understanding of what concept erasure methods actually accomplish.

Why Concept Erasure Matters: Fairness, Interpretability, and AI Safety

The practical stakes extend well beyond academic curiosity about learning dynamics. Concept erasure methods β€” techniques that remove information about a specified concept from a data representation β€” have become important tools in several domains:

Fairness and bias mitigation. If a model's internal representations contain information about protected attributes (race, gender, age), downstream classifiers may use that information even when it's not explicitly provided as input. Concept erasure offers a way to surgically remove this information before classification decisions are made, potentially reducing discriminatory outcomes. The LEACE method from Belrose et al. (2023) was specifically designed with this use case in mind, providing a provably minimal-distortion linear erasure that removes all linearly available information about a concept.

Interpretability and model understanding. Being able to control what features a model can access provides a powerful experimental tool for understanding what the model is actually using to make decisions. If you remove a particular kind of information and performance degrades in a predictable way, you gain evidence about the model's reliance on that information. The DSB hypothesis itself was tested using such methods.

AI safety and model steering. Related to concept erasure methods, recent work has shown that techniques for removing information from representations can also be used to bypass safety training in large language models (Marshall et al., 2024, cited in the paper's impact statement). Understanding precisely what these methods do β€” and what they fail to do β€” is therefore critical for both enabling beneficial applications and anticipating adversarial misuse.

Data preprocessing and learning dynamics. More broadly, the DSB suggests that if you want to encourage a model to learn higher-order, potentially more robust features, you might deliberately remove or reduce the salience of simple features during training. The paper's experiments on whether erasing simple features slows learning are essentially testing whether this strategy works, and the answer has implications for curriculum learning, data augmentation, and training recipe design.

However, all of these applications depend on a critical assumption: that removing low-order information actually prevents models from using it, and does not inadvertently inject new information through the erasure process itself. The paper's central contribution is demonstrating that this assumption breaks down for quadratic erasure methods in ways that are both subtle and consequential.

The Gap: Linear Erasure Exists, But Quadratic Erasure Was Underexplored

Prior to this work, the landscape of concept erasure methods had a clear gap between what was theoretically understood and what was practically needed.

LEACE provides provably correct linear erasure. The LEACE method from Belrose et al. (2023) removes all linearly available information about a concept from a representation. The key theorems state that if you can make the class-conditional means equal to the unconditional mean, then no linear classifier can perform better than chance on the erased data β€” and this condition is both necessary and sufficient for categorical cross-entropy loss. LEACE achieves this with minimal expected squared distortion to the data, using a closed-form optimal transport map. The method is well-understood, computationally efficient, and theoretically grounded.

But linear information is only first-order. Many important features in real data are encoded in second-order statistics β€” differences in variance or covariance structure between classes. For example, one class of images might have more variable pixel intensities than another, or specific pairs of pixels might co-vary differently across classes. A linear classifier cannot exploit these differences, but a neural network with even a single hidden layer can. To prevent networks from using these features, you need quadratic concept erasure β€” ensuring that class-conditional covariance matrices are equal, not just class-conditional means.

No quadratic erasure method existed. Before this paper, there was no method that could provably remove all quadratically available information about a concept while minimally distorting the data. The papers by Belrose et al. (2023, 2024) established the theoretical framework for understanding what polynomial information means (via moment tensors) and provided the linear solution (LEACE), but extending this to second-order moments β€” covariance matrices β€” presented new mathematical challenges. Covariance matrices are positive semidefinite and live on a curved manifold (the cone of PSD matrices), making the optimal transport problem significantly more complex than the linear case where means are vectors in Euclidean space. The optimal transport map between Gaussians with different covariance matrices involves matrix square roots of products of matrices rather than simple vector addition.

This gap was significant: if you wanted to test whether networks rely on quadratic statistics, or if you wanted to remove those statistics for fairness or safety applications, you had no principled way to do so.

Where Prior Approaches Fall Short

NaΓ―ve attempts at quadratic erasure risk injecting information. The paper identifies a subtle but critical issue: when you apply a class-dependent transformation to data (different transforms for different classes), you can inadvertently inject information about the class label into higher-order statistics, even as you remove it from the moments you're targeting. The authors make this vivid through geometric intuition: if each class originally lives in a bounded hypercube [0,1]d[0, 1]^d (pixel values), applying different affine transformations to different classes maps each class to a different characteristic hyperparallelepiped. A sufficiently expressive network can potentially read out the class label from the shape and position of these transformed regions, even though the class-conditional means and covariances are now identical.

This is not merely a theoretical concern β€” it is the mechanism behind the paper's central empirical finding of backfiring, where QLEACE-edited data ultimately enables better classification performance than unedited data on expressive architectures. The erasure method, designed to make learning harder, actually makes it easier by injecting higher-order Shannon information about the class label.

Label-free approximations may not erase enough. An obvious fix is to apply the same transformation to every datapoint regardless of class β€” a label-free approach that cannot inject class-specific information. However, a single global transformation cannot simultaneously make all class-conditional covariance matrices equal to the unconditional covariance matrix (unless the unconditional covariance is chosen to be degenerate, which would destroy all information in the data). The paper proposes ALF-QLEACE as an approximate solution, but this leaves a fraction of the quadratically available information intact β€” and the experiments show it sometimes acts as unintended data augmentation, making learning easier rather than harder.

Gradient-based moment matching is unprincipled. As an alternative, the paper experiments with directly optimizing pixel values using L-BFGS to minimize the differences between class-conditional and unconditional means and covariances, while keeping the modified images close to the originals. This approach avoids both the injection problem (no class-dependent transformation) and the under-erasure problem (you can optimize until the moment differences are arbitrarily small). However, it is computationally expensive, does not produce a reusable transformation function, and β€” as the results show β€” still fails to slow learning as effectively as linear erasure on some architectures, suggesting that partial quadratic information remains accessible even after aggressive optimization.

No systematic comparison existed. Perhaps most importantly, prior work had not systematically compared different erasure strategies on the same learning task, with the same architectures, using a consistent evaluation metric. Without such comparisons, it was impossible to know whether the choice of erasure method matters, whether results generalize across architectures, or whether apparently successful erasure might be masking information injection. This paper fills that gap by evaluating LEACE, QLEACE, ALF-QLEACE, and gradient-based erasure on the same three datasets (CIFAR-10, CIFARNet, SVHN) across five architecture families (ReLU MLPs, GELU MLPs, SwiGLU MLPs, ConvNeXt V2, Swin Transformer V2) with a consistent evaluation framework.

How This Paper Positions Itself Relative to Existing Work

The paper's positioning is deliberately constructive and cautionary rather than competitive. It does not claim to have "solved" quadratic concept erasure β€” quite the opposite. The paper's stance is that it has developed the first principled quadratic erasure method (QLEACE) and an approximate variant (ALF-QLEACE), and then through systematic experimentation revealed that all current quadratic erasure methods are unreliable in practice.

This is a distinct type of contribution. Rather than proposing a new method and claiming it works well, the paper:

  1. Derives QLEACE from optimal transport theory (Section 2.2), filling the gap left by LEACE's restriction to linear erasure. This derivation is mathematically non-trivial, building on the theory of Wasserstein barycenters for Gaussian distributions and the fixed-point algorithm of Álvarez-Esteban et al. (2016) for solving the barycenter covariance equation. The method guarantees that all classes will have equal means and equal covariances after transformation, while minimally distorting the data in expectation.

  2. Identifies the information injection problem as a fundamental limitation of any class-dependent quadratic erasure method. By mapping each class to a different region of the data space, QLEACE necessarily encodes class information in higher-order statistics β€” a fact that becomes empirically visible through the backfiring phenomenon.

  3. Proposes ALF-QLEACE as a partial remedy that avoids information injection by applying the same transformation to all datapoints, at the cost of incomplete erasure of quadratic information.

  4. Introduces gradient-based erasure as an alternative that avoids both problems but has its own limitations (computational cost, lack of a reusable transform).

  5. Evaluates all methods systematically, using prequential minimum description length (MDL) from Voita & Titov (2020) as the primary metric β€” a principled measure of learning difficulty that integrates the entire learning curve into a single number. MDL is equivalent to the area under the learning curve (loss vs. dataset size), so it captures both early and late training behavior, making it sensitive to phenomena like backfiring that only manifest late in training.

  6. Establishes a clear hierarchy of reliability: LEACE is consistently effective and architecture-independent; QLEACE backfires on expressive architectures; ALF-QLEACE and gradient-based erasure produce architecture-dependent and sometimes counterproductive effects.

The paper also connects to the maximal update parametrization (Β΅P) framework (Yang et al., 2021), using it to ensure that hyperparameters transfer across network widths. This choice is methodologically significant: it means the width-scaling results (where wider networks do not overcome the effects of LEACE, even toward infinite width) are not artifacts of poor hyperparameter tuning. The paper finds that LEACE makes learning more difficult even for feature-learning networks at infinite width, which is a stronger claim than simply showing it works at a single width. The scaling experiments also reveal that the backfiring effect with QLEACE is architecture-dependent β€” it appears strongly in ConvNeXts and Swin Transformers but only sporadically in MLPs (and then only on the CIFARNet dataset).

The use of schedule-free AdamW (Defazio et al., 2024) is another notable methodological choice. By eliminating the need to pre-specify a learning rate decay schedule, the authors can train networks to convergence and compute valid MDL comparisons without worrying about whether differences in final performance are due to suboptimal scheduling rather than genuine learning difficulty.

In summary, the paper positions itself at the intersection of concept erasure theory, optimal transport, and empirical learning dynamics. Its primary contribution is not a method that solves a problem, but a systematic demonstration that the problem β€” reliably removing quadratic information from datasets β€” is harder than previously appreciated, and that practitioners should be cautious when applying quadratic erasure methods in safety-critical or fairness-sensitive settings. The paper's title, "Slowing Learning by Erasing Simple Features," is intentionally understated: the results show that for quadratic erasure, the question of whether learning is slowed depends on the dataset, architecture, and erasure method in ways we do not yet fully understand.

3. Technical Approach

3.1 Reader Orientation

The paper constructs a suite of mathematical transformations that edit image datasets to remove progressively higher-order statistical information about class labels β€” first-order (class means) and second-order (class covariances) β€” and then trains neural networks on these edited datasets to measure how much harder learning becomes. The core problem is that while methods exist to provably remove linear information (making all classes share the same mean), no principled method existed for removing quadratic information (making all classes share the same covariance matrix) before this work β€” and the paper's key finding is that even after deriving such a method, the results are unreliable because quadratic erasure can inadvertently inject higher-order information that sophisticated architectures learn to exploit.

3.2 Big-Picture Architecture (Diagram in Words)

The system has three major stages:

  1. Erasure Transformation Design β€” For a given dataset, compute the optimal transformation that maps each class-conditional distribution to a shared target distribution, removing a specified order of statistical information (linear via LEACE, quadratic via QLEACE, ALF-QLEACE, or gradient-based optimization). These transformations produce edited versions of all training and test images.

  2. Neural Network Training β€” Train feedforward MLPs (ReLU, GELU, SwiGLU), ConvNeXt V2, and Swin Transformer V2 models on the erased datasets using Β΅P (maximal update parametrization) to ensure hyperparameter transfer across widths, with schedule-free AdamW optimization that runs to convergence without pre-specified decay schedules.

  3. Learning Difficulty Measurement β€” Compute the prequential Minimum Description Length (MDL), which integrates the entire cross-entropy loss curve over training time into a single scalar (bits per sample), quantifying how much "harder" learning is on erased data compared to the unmodified control dataset. Final converged losses are also reported.

Information flows: original dataset β†’ erasure transformation (class-dependent or class-independent) β†’ edited dataset β†’ neural network training with Β΅P-scaled hyperparameters β†’ loss curves β†’ MDL computation β†’ comparison across erasure methods, architectures, widths, and depths.

3.3 Roadmap for the Deep Dive

  • First, the formal definition of polynomial predictors and the necessary/sufficient conditions for concept erasure (Theorems 2.2 and 2.3) β€” because these theorems establish what must be equalized (the moment tensors up to order N) for a polynomial classifier of degree N to perform no better than chance, providing the theoretical target that all erasure methods aim to achieve.
  • Second, LEACE as the linear baseline β€” since LEACE is the proven, reliable method that all quadratic approaches are compared against, and understanding its guarantees (minimal distortion, closed-form, provable linear guardedness) sets the standard that quadratic methods aspire to.
  • Third, QLEACE and its optimal transport derivation (Theorem 2.6) β€” because this is the paper's primary technical contribution: extending the LEACE framework from first-order to second-order moments using Wasserstein barycenters and Gaussian optimal transport maps, giving a closed-form guarantee that all class-conditional means and covariances are equalized.
  • Fourth, the information injection problem and ALF-QLEACE β€” since the backfiring phenomenon that dominates the experimental results is a direct consequence of QLEACE's class-dependent transformation structure, and ALF-QLEACE is the paper's attempted remedy that trades incomplete erasure for no information injection.
  • Fifth, gradient-based moment erasure β€” as an alternative approach that avoids both injection and under-erasure through direct optimization, but introduces its own limitations.
  • Sixth, the evaluation framework β€” prequential MDL, Β΅P scaling, schedule-free optimization, and the experimental design for measuring whether erasure actually slows learning.

3.4 Detailed, Sentence-Based Technical Breakdown

This is primarily a methods and empirical analysis paper whose core idea is that extending concept erasure from linear to quadratic statistics is mathematically possible via optimal transport theory, but practically unreliable because class-dependent quadratic transformations inject higher-order information that expressive architectures can exploit β€” a finding revealed only through systematic comparison across erasure methods, architectures, and datasets.

What Information Must Be Removed: The Polynomial Predictor Framework

The paper's theoretical foundation rests on characterizing exactly what statistical information a polynomial classifier of degree N can extract from data. Rather than reasoning about neural networks directly (which are universal function approximators and can in principle use arbitrary nonlinear features), the paper defines the erasure target in terms of polynomial predictors β€” classifiers whose output for each class is a polynomial function of the input pixels.

Definition 2.1 formalizes a degree-N polynomial predictor. In Einstein summation notation (where repeated indices are implicitly summed over), the j-th component of the predictor's output β€” interpreted as the logit or likelihood that input $x$ belongs to class $j$ β€” is:

Ξ·(x)=b+βˆ‘n=1N(Ai1…in(n)xi1…xin)\eta(x) = b + \sum_{n=1}^{N} \left( A^{(n)}_{i_1 \ldots i_n} x_{i_1} \ldots x_{i_n} \right)

where $b \in \mathbb{R}^d$ is a bias vector, and each $A^{(n)}$ is an order $n+1$ coefficient tensor: its first $n$ axes each have size $d$ (the input dimensionality, one axis per factor of $x$), and its final axis has size $k$ (the number of classes). For $n = 1$, the term $A^{(1)}_{i_1} x_{i_1}$ reduces to a standard linear transformation $Wx$ where $W$ is a $d \times k$ matrix. For $n = 2$, the term $A^{(2)}_{i_1 i_2} x_{i_1} x_{i_2}$ is a quadratic form: for binary classification ($k = 1$), this is exactly $x^T A x + b^T x + c$ where $A$ is a $d \times d$ matrix.

What this definition captures: a polynomial predictor of degree N can exploit any statistical pattern in the data that is encoded in the first N moments of the class-conditional distributions. The first moment (mean) is a vector of size $d$: $\mathbb{E}[X_i | Z = z]$ for each pixel $i$ and class $z$. The second moment involves products $\mathbb{E}[X_i X_j | Z = z]$ which, together with the mean, determine the covariance $\text{Cov}(X_i, X_j | Z = z) = \mathbb{E}[X_i X_j | Z = z] - \mathbb{E}[X_i | Z = z]\mathbb{E}[X_j | Z = z]$. The N-th moment tensor $\mathbb{E}[X_{i_1} \ldots X_{i_N} | Z = z]$ captures all N-way interactions.

Theorem 2.2 (Sufficiency): If a loss function $\mathcal{L}$ is convex in the predictor's output $\eta(x)$, and if for every class $z$ and every order $n \in \{1, \ldots, N\}$, the class-conditional moment tensor equals the unconditional moment tensor:

E[Xi1…Xin∣Z=z]=E[Xi1…Xin]\mathbb{E}[X_{i_1} \ldots X_{i_n} \mid Z = z] = \mathbb{E}[X_{i_1} \ldots X_{i_n}]

then no degree-N polynomial predictor can achieve lower expected loss than the trivially attainable loss β€” the loss achieved by a constant predictor that ignores the input entirely and always outputs the same class probabilities.

The proof uses Jensen's inequality: because $\mathcal{L}$ is convex in $\eta(x)$, the expected loss is lower-bounded by the loss evaluated at the expected predictor output conditioned on the class. When the moment tensors are equal across classes, this expected output is the same for all classes, and therefore a constant predictor (which can achieve exactly this value) is optimal among all degree-N polynomial predictors.

Theorem 2.3 (Necessity): This is the converse direction. If the loss function has bounded partial derivatives, the off-category partial derivatives never vanish and do not depend on which (incorrect) category is considered (a property satisfied by categorical cross-entropy), and if the optimal degree-N polynomial predictor is the constant predictor (with all $A^{(n)} = 0$), then the moment tensors must be equal across classes.

The proof is a first-order optimality argument: at the optimum (the constant predictor), the gradient of the expected loss with respect to each coefficient tensor $A^{(n)}_{...j}$ must be zero. Setting these gradients to zero yields equations that directly imply the class-conditional moments equal the unconditional moments, provided the off-category partial derivatives are non-zero (so the equations are non-degenerate).

What these theorems jointly establish: For the categorical cross-entropy loss commonly used in classification, making all class-conditional moments up to order N equal to the unconditional moments is both necessary and sufficient to guarantee that no degree-N polynomial classifier can outperform chance. In plain language: if you want to prevent a linear classifier ($N = 1$) from using the data, you must equalize the means. If you want to prevent a quadratic classifier ($N = 2$) from using the data, you must equalize both the means and the covariances.

Why this matters for the paper's methodology: Neural networks with at least one hidden layer and nonlinear activations are not polynomial classifiers β€” they can exploit higher-order interactions beyond what any fixed-degree polynomial can represent. The paper's experiments are therefore probing a stronger condition: even if we perfectly remove all first- and second-order information, can networks still learn by exploiting third-order statistics (skewness), fourth-order (kurtosis), or even more complex patterns? The polynomial framework provides a precise characterization of what was removed, enabling the paper to attribute any remaining learnability to higher-order information β€” including any higher-order information inadvertently injected by the erasure process itself.

Linear Erasure via LEACE: The Proven Baseline

LEACE (LEAst-squares Concept Erasure) from Belrose et al. (2023) is the paper's reference method β€” the one approach that consistently and reliably slows learning across all architectures. Understanding LEACE is essential because it establishes the design pattern that QLEACE extends, and because its reliability provides the contrast against which quadratic methods are judged.

What LEACE guarantees. LEACE removes all linearly available information about the class label $Z$ from the data $X$. "Linearly available" means that no linear classifier β€” including logistic regression or a linear layer at the output of a network β€” can perform better than chance at predicting $Z$ from the transformed data $X'$. The necessary and sufficient condition from Theorem 2.3 for $N = 1$ is that all class-conditional means equal the unconditional mean:

E[Xβ€²βˆ£Z=z]=E[Xβ€²]βˆ€z∈Z\mathbb{E}[X' \mid Z = z] = \mathbb{E}[X'] \quad \forall z \in \mathcal{Z}

How LEACE achieves this. LEACE solves an optimal transport problem: find the transformation $T_z$ for each class $z$ that (1) makes the transformed class-conditional distribution have the target unconditional mean, and (2) minimally distorts the data in expectation. The objective is:

argminT1,…,Tkβˆ‘zΞ»zE[βˆ₯Tz(X)βˆ’Xβˆ₯22∣Z=z]\text{argmin}_{T_1, \ldots, T_k} \sum_{z} \lambda_z \mathbb{E}\left[ \|T_z(X) - X\|_2^2 \mid Z = z \right]

subject to the constraint that $\mathbb{E}[T_z(X) \mid Z = z] = \mathbb{E}[X'] = \bar{m}$ (the target unconditional mean, which is itself chosen to minimize total distortion).

The solution is a simple affine transformation per class: $T_z(x) = x - m_z + \bar{m}$, where $m_z$ is the original class-conditional mean and $\bar{m}$ is the weighted average of all class means. In words: subtract off each class's own mean and add back the global mean. This shifts each class's cloud of points so that they all center on the same location, removing the linear separability that comes from different classes occupying different regions of pixel space. Since the transformation only adds a constant vector per class, it is the minimal-distortion way to achieve mean equalization β€” any other transformation achieving the same constraint would move points further on average.

Key properties of LEACE. The transformation is closed-form (no optimization required, just compute means and apply the shift), deterministic (same input always maps to same output), and reusable (once computed on the training set, the same shift vectors can be applied to new test points using their class labels). The expected squared distortion is exactly the sum of squared distances from class means to the global mean, weighted by class probabilities.

What LEACE does NOT remove. LEACE does nothing to class-conditional covariances, higher moments, or any nonlinear structure. A neural network with a hidden layer can compute quadratic features like $(x_i - \bar{m}_i)^2$ or $(x_i - \bar{m}_i)(x_j - \bar{m}_j)$, which may differ in distribution between classes even though the means are equal. Removing this second-order information is the motivation for developing QLEACE.

Quadratic Erasure via QLEACE: The Central Technical Contribution

QLEACE (Quadratic LEAst-squares Concept Erasure) extends the LEACE framework to second-order statistics. The target is now stronger: after transformation, not only must all class-conditional means be equal, but all class-conditional covariance matrices must be equal as well β€” and both must equal the unconditional mean and covariance.

The mathematical challenge. For linear erasure, the optimal transport map between two distributions with different means but the same covariance is simply a translation (adding a constant vector). For quadratic erasure, the distributions differ in both means and covariances. The optimal transport map between two Gaussian distributions with different means and different covariance matrices β€” the map that minimizes expected squared Euclidean distance β€” is an affine transformation of the form:

T(x)=A(xβˆ’m)+mβ€²T(x) = A(x - m) + m'

where the matrix $A$ is given by a formula involving matrix square roots of products of the source and target covariance matrices:

A=Ξ£sourceβˆ’1/2(Ξ£source1/2Ξ£targetΞ£source1/2)1/2Ξ£sourceβˆ’1/2A = \Sigma^{-1/2}_{\text{source}} \left( \Sigma^{1/2}_{\text{source}} \Sigma_{\text{target}} \Sigma^{1/2}_{\text{source}} \right)^{1/2} \Sigma^{-1/2}_{\text{source}}

This is significantly more complex than the linear case because covariance matrices live on a curved manifold (the cone of positive semidefinite matrices), and the optimal interpolation between them involves taking matrix square roots β€” operations that are well-defined but computationally intensive and numerically sensitive.

Theorem 2.6 (Quadratic LEACE) is the paper's main theoretical result. It states that the optimal quadratic erasure transformation β€” the one that achieves equal means and covariances across all classes while minimally distorting the data in expectation β€” is given by a two-stage procedure:

Stage 1: Find the optimal target distribution. The target mean $\bar{m}$ and target covariance $\bar{\Sigma}$ are those of the Wasserstein barycenter of the class-conditional distributions, where each class is treated as Gaussian with its empirical mean $m_i$ and covariance $\Sigma_i$. Formally:

(mΛ‰,Ξ£Λ‰)=arg⁑min⁑(m,Ξ£)∈RdΓ—S++dβˆ‘i=1kΞ»iW22(N(mi,Ξ£i),N(m,Ξ£))(\bar{m}, \bar{\Sigma}) = \arg\min_{(m, \Sigma) \in \mathbb{R}^d \times \mathcal{S}^d_{++}} \sum_{i=1}^k \lambda_i W_2^2\left( \mathcal{N}(m_i, \Sigma_i), \mathcal{N}(m, \Sigma) \right)

where $W_2^2$ is the squared 2-Wasserstein distance between Gaussian distributions, $\lambda_i$ are the class weights (typically proportional to class frequencies), and $\mathcal{S}^d_{++}$ is the set of $d \times d$ symmetric positive definite matrices.

The solution for the barycenter mean is simply the weighted average of class means: $\bar{m} = \sum_i \lambda_i m_i$. The solution for the barycenter covariance $\bar{\Sigma}$ satisfies the fixed-point equation:

Ξ£Λ‰=βˆ‘i=1kΞ»i(Ξ£Λ‰1/2Ξ£iΞ£Λ‰1/2)1/2\bar{\Sigma} = \sum_{i=1}^k \lambda_i \left( \bar{\Sigma}^{1/2} \Sigma_i \bar{\Sigma}^{1/2} \right)^{1/2}

This equation says: the barycenter covariance is a matrix whose square root, when used to "whiten" each class covariance and then take the square root and average, reproduces itself. It cannot be solved in closed form; the paper uses the fixed-point iteration algorithm of Álvarez-Esteban et al. (2016) to compute $\bar{\Sigma}$ numerically.

What the fixed-point equation computes: Starting from an initial guess for $\bar{\Sigma}$ (e.g., the arithmetic mean of the $\Sigma_i$), each iteration updates the estimate by computing the right-hand side of the equation: multiply $\bar{\Sigma}^{1/2}$ by each $\Sigma_i$, take the matrix square root of each product, compute the weighted sum, and square the result. This converges to the unique positive definite solution β€” the matrix that is simultaneously "central" to all class covariances in the Wasserstein sense but close to each of them in the squared Riemannian metric induced by optimal transport.

Stage 2: Apply the optimal transport map per class. For each class $i$, the transformation from its original distribution to the barycenter is:

Ti(x)=Ξ£iβˆ’1/2(Ξ£i1/2Ξ£Λ‰Ξ£i1/2)1/2Ξ£iβˆ’1/2(xβˆ’mi)+mΛ‰T_i(x) = \Sigma_i^{-1/2} \left( \Sigma_i^{1/2} \bar{\Sigma} \Sigma_i^{1/2} \right)^{1/2} \Sigma_i^{-1/2} (x - m_i) + \bar{m}

This formula can be read operationally from the inside out: (1) center the datapoint by subtracting its class mean $m_i$, producing a zero-mean vector; (2) apply the matrix $\Sigma_i^{-1/2} \left( \Sigma_i^{1/2} \bar{\Sigma} \Sigma_i^{1/2} \right)^{1/2} \Sigma_i^{-1/2}$ which simultaneously "whitens" the data (removing its original covariance structure) and "re-colors" it with the target covariance $\bar{\Sigma}$; (3) add the barycenter mean $\bar{m}$ to shift the cloud to the common center.

Why this is the optimal form: Lemma 2.5 establishes that the optimal transport map between two distributions with means $m_P, m_Q$ and covariances $\Sigma_P, \Sigma_Q$ (with $\Sigma_P$ full rank) is exactly the affine map with the matrix $A$ given above, provided the target distribution $Q$ is the optimal one. Lemma 2.4 establishes that the optimal target (the barycenter) is Gaussian with mean $\bar{m}$ and covariance $\bar{\Sigma}$ as defined. Theorem 2.6 combines these: if you use the barycenter's mean and covariance as the target, and the optimal transport map to that target per class, you achieve the global minimum of the sum of squared Wasserstein distances β€” i.e., minimal expected squared distortion β€” subject to the constraint that all classes are mapped to distributions with the same mean and covariance. Any other transformation achieving equal moments would move points further on average.

Properties of the QLEACE transformation:

  • Clss-dependent: Each class $i$ gets its own affine transformation $T_i$ defined by its own mean $m_i$ and covariance $\Sigma_i$.
  • Closed-form given the barycenter: The only iterative component is solving for $\bar{\Sigma}$; once the barycenter is computed, each $T_i$ is a deterministic affine map.
  • Guarantees equality of means and covariances: By construction, the transformed class-conditional distributions all have mean $\bar{m}$ and covariance $\bar{\Sigma}$.
  • Minimal expected distortion: Among all transformations achieving this moment equalization, QLEACE achieves the lowest expected $\ell_2$ distortion.
  • Requires full-rank covariances: The $\Sigma_i^{-1/2}$ terms require each class's empirical covariance to be invertible, which holds when the number of samples per class exceeds the data dimensionality (or when regularization is applied).

The information injection problem β€” why QLEACE can backfire. The critical realization is that QLEACE's class-dependent transformations, while removing quadratic information, can inject higher-order information about the class label. The paper explains this with geometric intuition:

"Consider a dataset where each sample is a d-dimensional data point from one of k classes. The data naturally lies within a bounded hypercube [0, 1]d or [0, 255]d defined by the valid range of each dimension. By applying an erasure function specific to the class label of each sample, QLEACE effectively transforms the hypercube into k characteristic hyperparallelipipeds."

In plain language: the original data for all classes lives in the same bounded region of pixel space (a hypercube). After QLEACE applies different affine transformations to different classes, each class's data is mapped to a different region β€” a different hyperparallelepiped (an affine image of the original hypercube). The shape, orientation, and position of each class's transformed region encodes information about which class it belongs to. A neural network with sufficient capacity can learn to identify which region a datapoint falls in, and thereby recover the class label β€” even though within each region, the mean and covariance match those of the overall distribution.

This is the mechanism behind the backfiring phenomenon observed experimentally: QLEACE-edited data on ConvNeXt and Swin architectures initially shows very high loss (worse than LEACE), suggesting the network struggles to find usable features. But after many epochs, a sharp transition occurs where the loss plummets, ultimately achieving lower final loss than on the original unedited data. The network has discovered how to read out the injected higher-order information β€” the characteristic shape of each class's transformed hyperparallelepiped β€” and can actually classify more easily than on the original data where the features are more complex and natural.

The paper's experiments show this effect is architecture-dependent: feedforward MLPs rarely exhibit backfiring (except on the CIFARNet dataset for some model dimensions), while ConvNeXts and Swin Transformers β€” with their inductive biases for spatial structure and their greater expressive capacity β€” are highly susceptible. This suggests backfiring requires both sufficient model capacity to detect the shape of the transformed data regions and appropriate architectural biases to make that detection learnable within a reasonable number of epochs.

ALF-QLEACE: Approximate Label-Free Quadratic Erasure

To address the information injection problem, the paper proposes ALF-QLEACE (Approximate Label-Free QLEACE). The key design constraint is: apply the same transformation to every datapoint, regardless of its class label. This prevents any class-specific geometric distortion that could inject higher-order Shannon information. However, a single global transformation cannot simultaneously make all class-conditional covariances equal to the unconditional covariance β€” unless the transformation is degenerate (e.g., projecting everything to zero, destroying all information).

The compromise: partial erasure via projection. ALF-QLEACE works in two sequential steps:

Step 1: Apply LEACE. First, remove all linearly available information by applying the standard LEACE transformation (center each class at the global mean). After this step, all class-conditional means are equal, but the covariances still differ.

Step 2: Apply a rank $d - k$ projection that removes the directions of maximum covariance discrepancy. The goal is to find a projection matrix $P$ (of size $d \times d$, projecting onto a $(d - k)$-dimensional subspace) that, when applied to all datapoints, minimizes the maximum remaining discrepancy between class-conditional and global covariances in the projected space.

Formally, let $\Sigma_k$ denote the class-conditional covariance matrix for class $k$ (after LEACE), and let $\bar{\Sigma}$ be the average of all class-conditional covariances. Perfect quadratic guardedness would require:

Ξ£kβˆ’Ξ£Λ‰=0dΓ—d,βˆ€k∈K\Sigma_k - \bar{\Sigma} = 0_{d \times d}, \quad \forall k \in \mathcal{K}

meaning every class covariance equals the global average. This is impossible with a single projection unless $P = 0$ (which destroys all information). The ALF-QLEACE objective is instead:

arg⁑min⁑Pmax⁑k∈Kβˆ₯PΞ£kPTβˆ’PΞ£Λ‰PTβˆ₯22\arg\min_P \max_{k \in \mathcal{K}} \left\| P \Sigma_k P^T - P \bar{\Sigma} P^T \right\|_2^2

where $P$ is constrained to be a rank $d - k$ orthogonal projection. This minimizes the worst-case squared spectral norm of the covariance difference after projection β€” i.e., it makes the covariance matrices as similar as possible in the projected space, focusing on the class with the largest remaining discrepancy.

How the projection is computed. The min-max theorem implies that the optimal rank $d - r$ orthogonal projection of a matrix (with respect to both Frobenius and spectral norms) is given by truncating its singular value decomposition to the $d - r$ largest singular values β€” equivalently, projecting onto the subspace spanned by the top $d - r$ singular vectors. Applied to this problem:

  1. For each class $k$, compute the difference matrix $D_k = \Sigma_k - \bar{\Sigma}$.
  2. Identify the class $k^*$ whose $D_k$ has the largest spectral norm β€” this is the "worst offender" in terms of covariance discrepancy.
  3. Compute the singular value decomposition of $D_{k^*}$. The rank-1 projection that best approximates $D_{k^*}$ is given by its largest singular value and corresponding singular vectors.
  4. The optimal rank $d - 1$ projection $P^{(1)}$ projects onto the orthogonal complement of the direction that contributes most to this maximum singular value β€” specifically, it removes the singular vector corresponding to the largest singular value of $D_{k^*}$.
  5. This process can be iterated: after applying $P^{(1)}$, recompute the class covariances $\Sigma_k' = P^{(1)} \Sigma_k (P^{(1)})^T$ and the global average $\bar{\Sigma}'$, then repeat to remove up to $d$ rank-1 directions, each time targeting the current worst-offender class.

What ALF-QLEACE removes and what it leaves behind. Each rank-1 projection removes one direction from the data β€” specifically, the direction along which one class's variance differs most dramatically from the global average. After removing $r$ such directions, the data lives in a $(d - r)$-dimensional subspace. Within this subspace, the remaining covariance discrepancies are smaller β€” potentially much smaller β€” than in the original space. However, ALF-QLEACE does not guarantee equal covariances; it only reduces the maximum discrepancy iteratively. Some quadratically available information remains.

Key property: no information injection. Because ALF-QLEACE applies the same projection $P$ to every datapoint regardless of class, it cannot create the characteristic "class-specific hyperparallelepipeds" that cause QLEACE's backfiring. Any remaining discriminability comes from genuine differences in the (partially erased) data distribution, not from artifacts of class-dependent transformations.

Why label-free is a double-edged sword. The experiments reveal a surprising result: on some architectures (particularly convolutional networks), ALF-QLEACE produces lower MDL than LEACE alone β€” meaning the data is easier to learn after removing some quadratic information than after removing only linear information. The paper hypothesizes this is a data augmentation effect: by removing the directions of highest variance discrepancy between classes, ALF-QLEACE partially normalizes the covariance structure, which may act similarly to whitening or batch normalization β€” reducing internal covariate shift during training and making the remaining features more learnable. This is the opposite of the intended effect: rather than slowing learning by removing useful features, ALF-QLEACE inadvertently accelerates it by making the data more well-conditioned for gradient-based optimization.

Gradient-Based Quadratic Erasure: Direct Optimization of Pixel Values

As a conceptually simpler alternative to QLEACE and ALF-QLEACE, the paper experiments with gradient-based moment erasure: directly editing the pixel values of each image to minimize the differences between class-conditional and unconditional moments, while keeping the edited images close to the originals.

The optimization problem. The synthetic dataset is initialized as a copy of the original images. The optimization minimizes a loss function with three terms:

Ltotal=Ξ±β‹…Lmeans+Ξ²β‹…Lcovariances+Ξ³β‹…Lreconstruction\mathcal{L}_{\text{total}} = \alpha \cdot \mathcal{L}_{\text{means}} + \beta \cdot \mathcal{L}_{\text{covariances}} + \gamma \cdot \mathcal{L}_{\text{reconstruction}}

where:

  • $\mathcal{L}_{\text{means}}$ is the average squared distance between each class-conditional mean and the unconditional mean: $\sum_{z} \| \mathbb{E}[X' \mid Z = z] - \mathbb{E}[X'] \|_2^2$. Minimizing this term forces all classes to have the same mean.

  • $\mathcal{L}_{\text{covariances}}$ is the average squared distance between each class-conditional covariance matrix and the unconditional covariance matrix: $\sum_{z} \| \text{Cov}(X' \mid Z = z) - \text{Cov}(X') \|_F^2$, where $\|\cdot\|_F$ is the Frobenius norm. Minimizing this term forces all classes to have the same covariance.

  • $\mathcal{L}_{\text{reconstruction}}$ is the squared $\ell_2$ distance between the original images and their edited counterparts: $\sum_{i} \| X'_i - X_i \|_2^2$. This term keeps the edited images from drifting too far from the originals, preserving visual similarity.

The weights $\alpha$, $\beta$, and $\gamma$ are tuned to balance the three objectives β€” ensuring the edited dataset has almost no quadratically available information while staying visually close to the original images. The optimization uses L-BFGS (Limited-memory Broyden–Fletcher–Goldfarb–Shanno), a quasi-Newton optimizer well-suited to smooth, medium-scale optimization problems.

Pixel value constraint via reparameterization. To ensure pixel values remain within the valid range $[0, 255]$, the images are reparameterized using the sigmoid function: each pixel value is represented as $\sigma(z) \cdot 255$ where $z \in \mathbb{R}$ is the unconstrained optimization variable and $\sigma(z) = 1/(1 + e^{-z})$. This maps any real-valued $z$ to the interval $(0, 255)$, allowing unconstrained optimization while ensuring pixel validity.

Key differences from QLEACE and ALF-QLEACE:

  • No class-dependent transformation: Each image is edited independently; there is no single "eraser function" that maps class-conditionally. This avoids the information injection problem by construction.
  • No transformation reuse: Unlike LEACE and QLEACE, which produce a transformation function $T(x)$ that can be applied to new test points, the gradient-based method produces a specific edited dataset. Applying it to new data would require re-running the optimization including those new points.
  • Mathematically straightforward: The objective is simply moment matching plus a distance penalty β€” no optimal transport theory, matrix square roots, or fixed-point iterations required.
  • Potentially incomplete erasure: Despite minimizing the loss to near-zero on the training set, the edited dataset may still contain residual quadratic information accessible to neural networks β€” the optimization can get stuck in local minima, or the finite sample size may prevent perfect moment matching.

Why gradient-based erasure was included. It serves as a "sanity check" method: if even directly optimizing pixel values to equalize moments fails to slow learning on some architectures, that provides strong evidence that the difficulty is not about the particular erasure algorithm but about the fundamental challenge of removing usable information from high-dimensional data. Conversely, if gradient-based erasure successfully slows learning where QLEACE backfires, it demonstrates that the backfiring is indeed caused by information injection rather than by some inherent property of quadratic information removal.

The experimental results show the gradient-based method occupies an intermediate position: it increases MDL across all architectures without backfiring (success), but its efficacy relative to QLEACE varies β€” notably yielding lower MDL than QLEACE on feedforward networks (suggesting residual quadratic information remains accessible even after aggressive editing). This partial failure highlights the gap between optimizing a mathematical objective (moment equality) and actually preventing neural networks from extracting usable features.

Measuring Learning Difficulty: Prequential Minimum Description Length

The paper evaluates how much each erasure method "slows learning" using the prequential Minimum Description Length (MDL) framework from Voita & Titov (2020). This metric integrates the entire learning curve into a single scalar, capturing both early and late training behavior.

What prequential MDL computes. Conceptually, MDL measures the cumulative "surprise" of a model as it sees data sequentially. The formal definition is:

MDL=βˆ‘i=1NL(Ξ·ΞΈ<i(xi),zi)\text{MDL} = \sum_{i=1}^{N} \mathcal{L}(\eta_{\theta_{<i}}(x_i), z_i)

where $\eta_{\theta_{<i}}$ is the model trained on the first $i-1$ examples (or, in practice, on a batch up to index $i$), $(x_i, z_i)$ is the $i$-th example, and $\mathcal{L}$ is the cross-entropy loss. In words: for each position in the dataset, train the model on all previous examples, evaluate on the current example, and sum the losses.

In practice, computing this exactly would require training a model from scratch $N$ times (once after each new example). The paper uses the standard approximation: train a single model on the full dataset with a standard optimizer, record the per-epoch validation loss, and compute the area under the loss curve. The "prequential" aspect is approximated because the loss at epoch $t$ reflects training on all data seen up to epoch $t-1$, which is a reasonable proxy for sequential learning.

Why MDL rather than just final accuracy or final loss? The MDL captures learning dynamics, not just endpoints. This is essential for detecting backfiring: QLEACE-edited data may show higher loss than LEACE for most of training (indicating slower learning), but then a sharp drop late in training that brings the final loss below the unedited baseline. A metric based only on final loss would miss this β€” it would show QLEACE as "making learning easier" without revealing that it actually made early learning much harder. The MDL, by integrating over the full training trajectory, penalizes long periods of high loss even if the final loss is low.

The paper reports MDL as bits per sample (since cross-entropy is measured in bits with base-2 logarithm), and typically reports the increase in MDL relative to the unerased control: $\Delta\text{MDL} = \text{MDL}_{\text{erased}} - \text{MDL}_{\text{control}}$. A positive $\Delta\text{MDL}$ means the erasure made learning harder (the intended effect); a negative $\Delta\text{MDL}$ means the erasure made learning easier (backfiring).

Training Setup: Β΅P Scaling, Schedule-Free Optimization, and Architecture Details

The paper's experimental methodology is carefully designed to ensure fair comparisons across architectures and to avoid confounding factors that could masquerade as effects of erasure.

Maximal Update Parametrization (Β΅P). When scaling neural networks to different widths, standard parametrizations (like the default PyTorch initialization) cause the optimal learning rate and other hyperparameters to change with width. This means that a comparison between a narrow and wide network is confounded by hyperparameter tuning: differences in performance may reflect suboptimal hyperparameters for one width rather than genuine scaling behavior.

Β΅P (Yang et al., 2021) solves this by specifying how initialization variances, learning rates, and multiplier constants should scale with width to ensure that the "maximal update" behavior (where features evolve by $\Theta(1)$ per step regardless of width) is preserved. Under Β΅P, optimal hyperparameters for a narrow network transfer directly to wider networks β€” enabling the paper to sweep widths from 64 to 2048 neurons (for MLPs) without manually re-tuning hyperparameters at each width.

Depth scaling adaptations. For MLPs, the paper scales the learning rate with depth following Jelassi et al. (2023):

lr=lrbaseβ‹…LbaseLlr = lr_{\text{base}} \cdot \sqrt{\frac{L_{\text{base}}}{L}}

where $L$ is the number of layers. The exponent differs by architecture: $3/2$ for ReLU MLPs (following Jelassi et al.) and a more conservative $1/2$ for all other architectures. This compensates for the fact that deeper networks have more parameters and more sequential nonlinearities, requiring smaller learning rates to maintain stable training dynamics.

Schedule-free AdamW optimizer. The paper uses the schedule-free AdamW optimizer from Defazio et al. (2024). Conventional deep learning practice involves manually designing a learning rate schedule (e.g., cosine annealing, step decay) that specifies how the learning rate changes over epochs. This schedule interacts with the erasure treatment: if LEACE'd data requires more epochs to converge but the schedule decays the learning rate too early, the network may underfit β€” and this underfitting would be attributed to the erasure rather than to poor scheduling.

Schedule-free optimization eliminates the need for a pre-specified schedule. The optimizer internally maintains an interpolation between the current iterate and an exponential moving average, effectively adapting the "effective learning rate" based on optimization progress. The paper can therefore train "for as long as is necessary to achieve convergence" without worrying about whether convergence was prematurely halted by learning rate decay.

Data augmentation. Standard augmentations of random crops and horizontal flips are applied during training. Both are linear transformations (cropping selects a subset of pixels and translates them; flipping permutes and possibly negates coordinates), which cannot reintroduce erased information β€” they operate in the subspace of transformations that preserve whatever moment equalization the erasure has achieved.

Architectures studied. The paper trains five architecture families:

  • ReLU MLPs: Standard multi-layer perceptrons with rectified linear unit activations, varying width (64 to 2048) and depth (1 to 8 layers).
  • GELU MLPs: MLPs with Gaussian Error Linear Unit activations β€” a smooth alternative to ReLU that is common in transformer architectures.
  • SwiGLU MLPs: MLPs using the SwiGLU activation (a gated linear unit with Swish activation), which is used in models like PaLM and LLaMA.
  • ConvNeXt V2: A modern convolutional architecture that modernizes ResNets with design choices inspired by vision transformers (larger kernel sizes, layer normalization, inverted bottlenecks). Width and depth parameters control the base channel counts and number of blocks per stage, with the standard structure of four stages where depth is distributed as $[D, D, 3D, D]$ and width doubles in each successive stage.
  • Swin Transformer V2: A hierarchical vision transformer using shifted windows for efficient self-attention. Similar depth/width scaling structure with the number of heads also scaling in specific stages.

Datasets. Three image classification benchmarks are used:

  • CIFAR-10: 32Γ—32 color images across 10 classes, 50K training / 10K test.
  • CIFARNet: A synthetic variant from Belrose et al. (2024) designed for studying distributional simplicity bias.
  • SVHN (Street View House Numbers): 32Γ—32 color images of house number digits, with 10 classes (digits 0–9).

Evaluation protocol. For each combination of dataset, erasure method, architecture, width, and depth, the paper trains 5 models with different random seeds. The training runs continue until convergence (enabled by schedule-free optimization). The cross-entropy loss on a held-out validation/test set is recorded at each epoch. The prequential MDL is computed as the area under this loss curve. Results are reported as mean Β± standard error across the 5 seeds.

Z-score normalization experiments. The paper also investigates whether normalizing each pixel coordinate to zero mean and unit variance (standard z-score normalization) before erasure affects the results. This is motivated by the hypothesis that ALF-QLEACE's normalization-like effect (removing high-variance directions) might interact with explicit normalization. The results on this experiment are described as producing "ambiguous results" (Table 16), with normalization "appreciably reducing MDL on linearly erased data, resulting in a lower mean MDL than for approximately quadratically erased data."

4. Key Insights and Innovations

Innovation 1: Quadratic Concept Erasure Is Not a Natural Extension of Linear Erasure β€” It's a Fundamentally Different Problem Where the Method Itself Can Inject Information

The paper's most important conceptual contribution is not QLEACE itself, but the diagnostic finding that moving from linear to quadratic concept erasure introduces a qualitatively new failure mode that has no analog in the linear case. Before this work, the implicit assumption in the concept erasure literature was that the same theoretical framework that works for linear erasure β€” find a minimal-distortion transformation that equalizes the target moments across classes β€” would naturally extend to higher orders. LEACE (Belrose et al., 2023) proved that for first-order moments (means), this produces a clean, reliable, architecture-independent method. The natural next step was to extend this to second-order moments (covariances), and QLEACE represents the mathematically correct way to do so.

What the paper reveals, through systematic experimentation, is that this extension is not merely a technical challenge but a conceptual discontinuity. The geometric intuition the authors provide β€” that applying different affine transformations to different classes maps each class to a "characteristic hyperparallelepiped" β€” crystallizes the problem. Linear erasure only translates each class's point cloud (subtract class mean, add global mean). This translation does not change the shape, orientation, or volume of the region each class occupies; it only changes its center. A neural network looking at the transformed data sees all classes superimposed at the same location, with no geometric cue about which class a point belongs to beyond the (now-equalized) first-order statistics.

Quadratic erasure, by contrast, applies different shearing, rotation, and scaling transformations to each class because the optimal transport map between Gaussians with different covariances is not just a translation β€” it's a full affine transformation involving matrix square roots. Each class's data gets stretched and rotated differently. Even though the class-conditional covariances are now identical, the fact that different transformations were applied to different classes encodes class identity in the shape of the region each class occupies. A sufficiently expressive network can learn to detect "which stretching pattern was applied to this datapoint" and thereby recover the class label. This is information injection β€” the erasure process creates new discriminative features that did not exist in the original data.

The significance of this finding extends beyond concept erasure to any method that applies class-conditional preprocessing to remove statistical signals. It establishes a fundamental tension: class-dependent transformations can remove information from the moments they target while simultaneously encoding information in higher-order statistics, and the more aggressive the transformation (quadratic vs. linear), the more severe this encoding can be. This is not a flaw in the specific algorithm (QLEACE) but a structural property of class-conditional affine maps β€” any method that equalizes both means and covariances via per-class transforms faces the same issue.

The empirical evidence for this framing is the backfiring phenomenon observed most dramatically in ConvNeXt V2 models on QLEACE-edited CIFAR-10 (Figures 7, 12, and Table 16). QLEACE produces the highest early-epoch loss of any erasure method β€” the network genuinely struggles to find usable features, consistent with successful removal of low-order information. But after approximately 16 epochs, a sharp transition occurs: loss plummets rapidly, ultimately achieving lower final loss than models trained on unedited data. ConvNeXt models on QLEACE achieve a final MDL of 1.67 Β± 0.20 bits per sample compared to 5.09 Β± 0.09 for the unerased control (Table 16, bottom) β€” the erasure method designed to slow learning has instead produced the easiest-to-learn dataset in the entire study for this architecture. This is not an incremental performance difference; it's a sign reversal. The model has discovered and exploited the injected higher-order information, and the learning dynamics (prolonged struggle followed by sudden mastery) are the signature of a network transitioning from trying to use erased low-order features to discovering the artificial ones the erasure process created.

Contrast this with Swin Transformers: QLEACE produces a backfiring effect on final loss but the prolonged high-loss period during early training produces MDL that still exceeds the unerased baseline (9.08 Β± 0.13 vs. 8.18 Β± 0.03; Table 16). This shows backfiring is not all-or-nothing β€” the MDL metric captures the tradeoff between early difficulty and late recovery, and different architectures resolve this tradeoff differently.

The paper thus establishes a new diagnostic category β€” backfiring β€” that should be a standard evaluation criterion for any concept erasure method. A method that backfires is worse than ineffective; it accelerates learning of the very concept it was designed to hide.

Innovation 2: Label-Free Approximations as an Unintended Regularization or Data Augmentation Mechanism

The paper's second conceptual contribution emerges from the failure modes of the proposed fixes to QLEACE's information injection problem. ALF-QLEACE was designed as a principled compromise: apply the same transformation to all datapoints (no class-conditional processing, no information injection), at the cost of only approximately equalizing covariances (removing the directions of maximum discrepancy via iterative rank-1 projections). The expectation was that this would produce a clean, if partial, quadratic erasure β€” slowing learning less dramatically than perfect quadratic erasure would, but reliably and without backfiring.

The experimental results reveal something stranger and more interesting: ALF-QLEACE sometimes makes learning easier than LEACE alone. Despite applying LEACE as its first step (removing all linear information) and then additionally removing the principal directions of covariance discrepancy, the resulting data is less difficult for neural networks than data that only had linear information removed. This is visible in Figure 3 (right panel): for ConvNeXt V2 architectures, ALF-QLEACE produces a lower relative increase in MDL compared to LEACE across nearly all width and depth configurations. On CIFAR-10 with ConvNeXt (Table 16, bottom), ALF-QLEACE achieves an MDL of 4.92 Β± 0.05 versus 5.20 Β± 0.15 for LEACE β€” the quadratic "erasure" has actually made the data 0.28 bits per sample easier to learn.

The paper's hypothesis β€” that this is a data augmentation effect β€” reframes what ALF-QLEACE is actually doing. By identifying and removing the directions along which classes differ most in variance, the projection effectively performs a partial whitening or covariance normalization. This reduces the condition number of the optimization landscape: features that varied wildly in scale between classes (making gradient descent inefficient) are brought into a more uniform range. The projection is not erasing usable information so much as re-formatting the remaining information into a more learnable representation. This is analogous to how batch normalization (Ioffe & Szegedy, 2015) accelerates training β€” not by removing information, but by reducing internal covariate shift and conditioning the loss surface.

This finding challenges the implicit assumption that "removing statistical information = making learning harder." Information removal, in the Shannon sense, is not the same as removing features that gradient descent can efficiently exploit. A projection that removes some variance structure may simultaneously make the remaining variance structure more accessible to first-order optimization methods β€” a tradeoff that has no analog in the information-theoretic framework that motivates concept erasure. The concept erasure literature has focused on what information is available (can a Bayes-optimal classifier use it?), but ALF-QLEACE's behavior suggests that what matters for practical learning is what information is learnable under gradient-based optimization with finite data and finite time.

The gradient-based erasure method reinforces this interpretation. Despite directly optimizing pixel values to minimize moment differences β€” a method that can, in principle, reduce quadratic information to arbitrarily low levels β€” the resulting datasets produce MDL values that are higher than the control but lower than QLEACE on feedforward networks (Figure 5). This suggests that even aggressive moment matching leaves residual quadratic structure that MLPs can exploit, and that the optimization process itself may reorganize pixel values in ways that incidentally create learnable features. The gradient-based method is a more direct attack on the moment-matching objective than QLEACE, yet it is less effective at actually slowing learning β€” the very definition of Goodhart's law applied to concept erasure objectives.

Innovation 3: Architecture-Dependence as a First-Class Property of Concept Erasure Efficacy

A methodological innovation of the paper is treating architecture choice not as a nuisance variable to control for but as a primary axis of variation that reveals fundamental properties of erasure methods. Prior work on concept erasure (Belrose et al., 2023, 2024) focused primarily on probing and linear classifiers, with neural network training used to validate that erased representations don't contain usable information. By systematically sweeping across five architecture families (ReLU MLPs, GELU MLPs, SwiGLU MLPs, ConvNeXt V2, Swin Transformer V2), three datasets (CIFAR-10, CIFARNet, SVHN), and multiple width/depth configurations, the paper reveals that the answer to "does quadratic erasure work?" is not yes or no but "it depends on the architecture in ways we don't fully understand."

LEACE is the reference case: Figure 3 shows that the MDL increase from linear erasure is remarkably consistent across MLPs and ConvNeXts, with both architectures showing similar positive slopes as width increases (the erased data remains harder than the control across all widths). This consistency is evidence that LEACE genuinely removes a fundamental learnable signal β€” class-conditional means β€” that all architectures rely on, regardless of their inductive biases. When the erased feature is truly universal, the architecture doesn't matter.

Quadratic erasure breaks this universality. QLEACE backfires dramatically on ConvNeXts (negative MDL increase at some widths in Figure 3, right panel; final MDL of 1.67 vs. 5.09 control in Table 16), produces elevated MDL without backfiring on Swin Transformers (9.08 vs. 8.18 control), and shows sporadic backfiring on MLPs only on the CIFARNet dataset (Figure 8). ALF-QLEACE reduces MDL relative to LEACE on ConvNeXts but not on MLPs. Gradient-based erasure increases MDL more on ConvNeXts than on MLPs (Figures 3 and 5).

This architecture-dependence is not a bug in the experimental design β€” it is the key finding. It means that the information injected by class-dependent quadratic transformations is not universally accessible. Convolutional architectures, with their translation equivariance and hierarchical feature extraction, appear particularly well-suited to detecting the "shape" of the characteristic hyperparallelepipeds that QLEACE creates. The spatial structure of images matters: if QLEACE stretches one class's data along certain pixel dimensions and rotates another class's data, a ConvNet's local receptive fields and shared filters can detect these geometric distortions as texture-like patterns. An MLP, lacking this spatial inductive bias, must learn to detect the distortions through unconstrained weight connections β€” apparently a harder optimization problem that only succeeds on certain dataset/architecture combinations (the CIFARNet backfiring cases).

This finding reframes concept erasure from a purely statistical question ("has the mutual information between X and Z been reduced?") to a joint statistical-architectural question ("has the mutual information been reduced in a way that a specific architecture with a specific optimizer can recover?"). The paper's use of Β΅P is critical here because it ensures the architecture comparisons are fair β€” without Β΅P, the observed differences might reflect hyperparameter mismatch rather than genuine representational differences. The depth scaling experiments (Figures 4–8) further reveal that deeper networks are sometimes more susceptible to backfiring and sometimes not, depending on the activation function and dataset β€” another dimension of architecture-dependence that complicates any simple story about capacity being the key factor.

Innovation 4: MDL as the Right Metric for Detecting Concept Erasure Failure Modes

The paper's adoption of prequential Minimum Description Length as the primary evaluation metric is a methodological innovation that enables the discovery of backfiring. If the paper had reported only final test accuracy or final cross-entropy loss β€” the standard metrics in most concept erasure and representation probing work β€” the backfiring phenomenon would have been either invisible or misleading.

Consider the ConvNeXt V2 result on QLEACE-edited CIFAR-10 (Table 16, bottom). The final MDL of 1.67 bits per sample is dramatically lower than the control's 5.09. If one looked only at final loss curves, one would conclude that QLEACE made learning trivially easy β€” a catastrophic failure of the erasure. But the loss curves in Figure 12 tell a more nuanced story: QLEACE produces the highest loss of any method for the first ~16 epochs, exceeding even LEACE. The network is genuinely struggling β€” the quadratic erasure is working as intended during early training, forcing the network to search for usable features rather than exploiting easy linear ones. Then, abruptly, the network discovers the injected higher-order information, loss plummets, and the final converged loss is lower than the control.

The MDL metric integrates over this full trajectory: the prolonged period of high loss penalizes the total score, while the eventual low loss reduces it. The result (MDL below control) tells you that the eventual recovery more than compensates for the early struggle β€” the network ultimately has an easier overall learning experience on QLEACE-edited data because, once it finds the injected features, classification becomes trivially easy. A metric based only on the endpoint (final loss) would miss the early struggle entirely; a metric based only on early loss (e.g., loss at epoch 10) would miss the recovery. MDL captures the full story, and it is precisely this integrative property that makes backfiring visible as a phenomenon distinct from both "erasure works" (MDL > control throughout) and "erasure does nothing" (MDL β‰ˆ control throughout).

This is not simply a better metric for concept erasure β€” it's a metric that defines a new category of failure mode. Backfiring as a concept only makes sense in the context of a metric that captures learning dynamics over time. The paper's contribution is not just identifying that QLEACE can produce lower final loss than the control, but characterizing the temporal signature of this effect (prolonged high loss, sharp transition, eventual mastery) and naming it as a distinct phenomenon with its own implications. This temporal signature provides diagnostic value: if a new erasure method produces learning curves that look like QLEACE's on ConvNeXt, that's strong evidence that the method is injecting recoverable higher-order information, even if the final loss is high.

The paper's use of MDL also connects to broader discussions in the interpretability and probing literature. Voita & Titov (2020) originally proposed prequential MDL as a way to measure how much linguistic information is "used" by a model during training, rather than merely "present" in its representations. The paper adapts this framework to the inverse problem: instead of measuring how much information a model extracts from data, it measures how much information the data makes available to the model at each stage of learning. This inversion is conceptually clean and could be adopted by future work on data interventions and training dynamics.

Innovation 5: The Wasserstein Barycenter as the Unifying Principle for Optimal Multi-Class Concept Erasure

While the mathematical derivation of QLEACE is presented in Section 3, the conceptual insight that makes it novel is the recognition that the Wasserstein barycenter β€” not the arithmetic mean or any simpler aggregation β€” is the correct target distribution for optimal multi-class concept erasure. This is not an incremental application of existing optimal transport results; it solves a subtle coordination problem that arises specifically when erasing information from multiple classes simultaneously.

The problem, at its core, is this: to erase quadratic information from k classes, you need to map all k class-conditional distributions to a single shared target distribution with a common mean and covariance. The target distribution cannot be arbitrary β€” it must be chosen to minimize the total distortion across all classes. If you pick a target that is close to one class but far from another, you minimize distortion for one class at the expense of large edits for another, violating the "least-squares" (minimal total distortion) principle that makes LEACE practically useful.

The naive approach would be to pick the unconditional mean and unconditional covariance of the original data as the target. But this does not minimize expected distortion: the Wasserstein distance between Gaussians is not linear in the covariance matrices, so the matrix that minimizes the sum of squared Wasserstein distances is not the arithmetic mean of the individual covariances. The barycenter equation ($\bar{\Sigma} = \sum_i \lambda_i (\bar{\Sigma}^{1/2} \Sigma_i \bar{\Sigma}^{1/2})^{1/2}$) defines a fixed point where the target covariance is simultaneously "central" to all class covariances under the non-Euclidean geometry induced by the Wasserstein metric on the PSD cone. This is the Gaussian analog of the Euclidean fact that the point minimizing the sum of squared distances to a set of points is their arithmetic mean β€” but for covariance matrices under the Wasserstein distance, the "mean" is not the arithmetic mean but the solution to this nonlinear fixed-point equation.

The paper's invocation of this result adapts prior work on Gaussian Wasserstein barycenters (RΓΌschendorf & Uckelmann, 2002; Álvarez-Esteban et al., 2016) to the concept erasure setting. The recognition that concept erasure is an optimal transport problem β€” and specifically a barycenter problem when multiple distributions must be mapped to a common target β€” provides a principled foundation that contrasts with the more ad-hoc gradient-based and projection-based methods also evaluated. It explains why QLEACE has the minimal-distortion property: the Wasserstein barycenter is, by definition, the distribution that minimizes the sum of squared Wasserstein distances to the class-conditional distributions. Any other target distribution would require moving points further on average.

Moreover, this framing connects concept erasure to the broader literature on domain adaptation, dataset alignment, and distribution matching, where Wasserstein distances and barycenters are standard tools. The paper implicitly suggests that concept erasure should be understood as a special case of multi-source domain alignment, where the goal is to align multiple source distributions (the classes) to a common target, rather than aligning a source to a target as in standard domain adaptation. This reframing opens connections to techniques like Wasserstein barycentric coordinates and regularized optimal transport that could inform future erasure methods.

The limitation, of course, is that the Gaussian assumption (which makes the barycenter tractable) is an approximation β€” real data is not Gaussian, and the optimal transport map between non-Gaussian distributions with matched first and second moments is not necessarily affine. The paper acknowledges this implicitly by applying QLEACE to real image data rather than Gaussian synthetic data, testing whether the Gaussian-derived optimal map is sufficiently good in practice. The backfiring results suggest that the Gaussian approximation is good enough for moment equalization (the method achieves its stated goal) but that the non-Gaussian higher-order structure of the transformed data β€” the "characteristic hyperparallelepipeds" β€” becomes the dominant signal that networks exploit. This is a nuanced finding: the method's theoretical foundation is sound for what it aims to do, but the gap between the Gaussian model and real data creates an exploitable residual that the theory does not account for.

5. Experimental Analysis

Evaluation Methodology

  • Datasets. Three image classification benchmarks are used: CIFAR-10 (Krizhevsky et al., 2009) β€” 32Γ—32 color images across 10 classes with 50K training and 10K test examples; CIFARNet (Belrose et al., 2024) β€” a synthetic variant designed for studying distributional simplicity bias; and SVHN (Street View House Numbers, Netzer et al., 2011) β€” 32Γ—32 color images of house number digits with 10 digit classes. CIFAR-10 serves as the primary benchmark for most scaling experiments, while CIFARNet and SVHN provide tests of whether findings generalize across data distributions with different statistical structure. All three datasets represent closed-form classification tasks where performance can be cleanly measured, and their small image size (32Γ—32) makes them computationally tractable for the extensive width/depth sweeps and 5-seed averaging protocol.

  • Base models. Five architecture families are trained: ReLU MLPs (standard multi-layer perceptrons with rectified linear unit activations, swept from width 64 to 2048 and depth 1 to 8 layers), GELU MLPs (Gaussian Error Linear Unit activations, same width/depth ranges), SwiGLU MLPs (gated linear units with Swish activation, same ranges), ConvNeXt V2 (Woo et al., 2023 β€” a modernized convolutional architecture with base depths swept from roughly 40 to 65 and depths from 2 to 4, using the standard four-stage structure with width doubling per stage and depth distributed as [D, D, 3D, D]), and Swin Transformer V2 (Liu et al., 2022 β€” a hierarchical vision transformer with shifted window attention, base widths swept from 32 to 128 and depths from 2 to 8). The MLP families test whether activation function interacts with erasure efficacy; the ConvNeXt and Swin families test whether state-of-the-art architectures with spatial inductive biases respond differently to erasure than simple feedforward networks. The use of Β΅P (maximal update parametrization, Yang et al., 2021) across all architectures ensures that hyperparameters optimized for narrow models transfer directly to wider ones, removing hyperparameter mismatch as a confound in the width-scaling comparisons. All models are trained from scratch on erased data β€” no pretraining or transfer learning is used.

  • Metrics. The primary metric is the prequential Minimum Description Length (MDL) (Voita & Titov, 2020), computed as the area under the cross-entropy loss curve over the full training trajectory and reported in bits per sample. MDL integrates both early and late training behavior into a single scalar: a high MDL indicates the model struggled to compress the data (learning was slow or incomplete), while a low MDL indicates easy learning. The paper primarily reports the increase in MDL relative to the unerased control (Ξ”MDL = MDL_erased βˆ’ MDL_control), where positive values indicate erasure successfully slowed learning and negative values indicate backfiring (erasure made learning easier than on original data). Final converged cross-entropy losses are also reported in Table 16 to capture endpoint behavior. Results are averaged over 5 random seeds with standard errors. The MDL computation uses validation set loss, not training loss, to avoid confounding by overfitting.

  • Baselines. The central baseline is the unerased control dataset β€” the original images with no erasure applied, training the same architectures under identical conditions. For erasure comparisons, LEACE (Belrose et al., 2023) serves as the proven linear erasure baseline against which all quadratic methods are measured. Each quadratic method (QLEACE, ALF-QLEACE, gradient-based) is compared to LEACE to determine whether removing quadratic information provides additional slowing beyond removing only linear information. A random projection of equal rank to ALF-QLEACE is included in Figure 1 for visual comparison but is not a formal learning baseline. The paper does not include baselines like random label shuffling, Gaussian noise injection, or standard data augmentations as alternative "difficulty-increasing" interventions β€” the comparisons are entirely within the concept erasure framework.

  • Generation budget / compute accounting. The paper's "compute budget" is not measured in FLOPs or wall-clock time but is implicitly controlled through matched training epochs and matched architecture configurations. All erasure methods are applied to produce static edited datasets before training begins; there is no test-time compute allocation to compare. The fairness of comparisons rests on using identical training protocols (same architecture, same optimizer, same number of epochs, same data augmentation of random crops and horizontal flips) across all erasure conditions within each experiment. The Β΅P scaling ensures that wider or deeper models do not require different hyperparameter tuning budgets β€” optimal learning rates and initialization scales transfer from narrow to wide models without additional search. Schedule-free AdamW (Defazio et al., 2024) eliminates the need to tune learning rate decay schedules, meaning all models are trained until convergence without early stopping decisions that could bias comparisons. The crucial caveat is that the computational cost of producing the erased datasets β€” computing Wasserstein barycenters via fixed-point iteration for QLEACE, running L-BFGS for gradient-based erasure β€” is not included in any cost comparison. In practice, QLEACE requires solving the fixed-point equation for the barycenter covariance (iterative, involving matrix square roots of dΓ—d matrices at each step), while gradient-based erasure requires optimizing all pixel values of all training images jointly, potentially for many L-BFGS iterations. These costs are substantial but are treated as one-time preprocessing rather than part of the learning budget.

  • Cross-validation / statistical protocol. No formal cross-validation is used for hyperparameter selection because Β΅P is designed to eliminate the need for per-configuration tuning. The learning rate for each architecture family is set based on the narrowest, shallowest configuration and transferred using Β΅P scaling rules. For depth scaling, the learning rate is adjusted as lr_base Γ— sqrt(L_base / L) with exponent 3/2 for ReLU MLPs (following Jelassi et al., 2023) and 1/2 for all other architectures. Each (dataset, eraser, architecture, width, depth) configuration is repeated across 5 random seeds, and results are reported as mean Β± standard error across seeds. The paper does not perform statistical significance tests (t-tests, confidence intervals for MDL differences between erasure methods) beyond reporting standard errors, so claims about one method producing "higher" or "lower" MDL than another should be interpreted as comparing means with the reported uncertainty. For the z-score normalization experiment (Table 16), results are reported on "base model sizes" β€” the smallest or default width/depth configuration β€” rather than being swept across the full scaling range, limiting the generality of those findings.

Main Quantitative Results

Linear Erasure (LEACE) Consistently Slows Learning Across All Architectures and Configurations

The headline finding for linear erasure is that LEACE increases prequential MDL across all tested architectures, widths, depths, and datasets, with no evidence of backfiring or architecture-dependent reversal. Figure 3 (left panels) shows the MDL increase from linear erasure for ReLU MLPs (top left) and ConvNeXt V2s (bottom left) on CIFAR-10 as a function of width. For MLPs, the MDL increase rises from roughly 2 bits per sample at width 64 to approximately 4 bits per sample at width 2048, with a nearly monotonic positive trend β€” wider networks actually suffer more relative difficulty from linear erasure, not less. For ConvNeXts, the increase is smaller in magnitude (roughly 1–2 bits per sample) and relatively flat across widths 40 to 65, with some fluctuation around 1.5–2.5 bits per sample. The key insight from this comparison is that increasing model width does not allow the network to overcome the erasure β€” under Β΅P, even networks approaching infinite width (the feature-learning limit; Yang & Hu, 2020; Vyas et al., 2024) cannot recover the linearly erased information. If wider networks could learn to reconstruct or circumvent the erasure, the MDL increase would shrink with width; instead it grows (for MLPs) or remains stable (for ConvNeXts). This establishes LEACE as removing a fundamental and irrecoverable signal β€” class-conditional means are genuinely necessary for efficient learning, and no amount of overparametrization substitutes for their absence.

Figure 4 confirms this pattern across activation functions: ReLU MLPs, GELU MLPs, and SwiGLU MLPs all show positive MDL increases from LEACE that grow with width (from roughly 2 to 4 bits per sample across widths 64–2048) and are relatively flat or slightly increasing with depth (from roughly 2–4 bits per sample across depths 1–8). The consistency across activation functions suggests that the linear erasure effect is not mediated by a specific nonlinearity β€” all these architectures rely on class-conditional mean differences as a primary learning signal, and removing that signal uniformly degrades their performance.

Figure 6 shows the LEACE results for Swin Transformers and ConvNeXts across widths and depths. For Swin Transformers (left panel), the MDL increase is roughly 2–5 bits per sample across widths 32–128, with a slight upward trend. For ConvNeXts (right panel), the increase is roughly 1–3 bits per sample across widths 40–65, relatively flat. The depth trends (bottom panels) show similar patterns: MDL increase is roughly 2–4 bits per sample for Swin at depths 2–8, and roughly 1–4 bits per sample for ConvNeXt at depths 2–4 with some non-monotonicity.

Dataset transfer. Figure 8 extends these findings to CIFARNet and SVHN using ReLU MLPs. On SVHN (top row), LEACE increases MDL by roughly 0.5–1.5 bits per sample across widths 64–2048, with the increase growing with width. On CIFARNet (bottom row, left panel), the LEACE MDL increase is roughly 1–2 bits per sample, also growing with width. Across all three datasets (CIFAR-10, CIFARNet, SVHN), the qualitative pattern is identical: LEACE consistently increases MDL, the effect magnitude is comparable across datasets, and wider networks show larger (or at least not smaller) increases. Table 16 (bottom) provides the final MDL values for base model sizes on z-score normalized CIFAR-10: LEACE produces MDL increases of +1.35 bits per sample for MLPs (8.49 vs. 7.14 control), +0.97 for LeNets (6.59 vs. 5.62), +0.11 for ConvNeXt V2 (5.20 vs. 5.09), and +0.82 for Swin V2 (9.00 vs. 8.18). The smaller effect on ConvNeXt is notable but still positive β€” LEACE never backfires.

QLEACE Produces Architecture-Dependent Backfiring, with ConvNeXt V2s Achieving Lower MDL Than Unerased Controls

The headline finding for QLEACE is that it can backfire dramatically on expressive architectures, ultimately making learning easier than on unerased data, but this effect is highly architecture-dependent and dataset-dependent. Figure 3 (right panels) shows the MDL increase from quadratic erasure on CIFAR-10 for ReLU MLPs (top right) and ConvNeXt V2s (bottom right). For MLPs, QLEACE produces a positive MDL increase across all widths β€” roughly 2–6 bits per sample at width 64 rising to 4–10 bits per sample at width 2048, depending on the specific erasure variant. QLEACE (the exact method) produces the largest increase among quadratic methods, achieving roughly 4–10 bits per sample across the width range, consistently higher than both ALF-QLEACE and gradient-based erasure. Critically, there is no sign reversal β€” QLEACE never produces negative MDL increase for MLPs on CIFAR-10, meaning it successfully slows learning beyond what LEACE achieves.

For ConvNeXt V2s (Figure 3, bottom right), the picture is radically different. QLEACE produces negative MDL increase at several width configurations β€” the data is easier to learn than the unerased control. The MDL increase for QLEACE ranges from roughly -2 to +6 bits per sample across widths 40–65, with a pronounced dip into negative territory. By contrast, gradient-based erasure produces consistently positive MDL increases (roughly 1–4 bits per sample), and ALF-QLEACE produces small positive or near-zero increases (roughly 0–2 bits per sample, substantially lower than LEACE's increase of 1–2 bits per sample shown in the left panel). The QLEACE curve's negative values are the quantitative signature of backfiring.

Table 16 (bottom) crystallizes this finding with final MDL values on z-score normalized CIFAR-10 for base model sizes. ConvNeXt V2 achieves an MDL of 1.67 Β± 0.20 bits per sample on QLEACE-edited data β€” dramatically lower than the 5.09 Β± 0.09 for the unerased control, and lower than any other erasure method (LEACE: 5.20, ALF-QLEACE: 4.92, Gradient: 5.37). This is a >3 bit per sample reduction β€” the QLEACE-edited data is not merely easier than the unerased control; it is easier by a margin larger than the effect of any other erasure method in either direction. Swin Transformer V2 shows a more nuanced pattern: QLEACE achieves MDL of 9.08 Β± 0.13, which is higher than the control's 8.18 Β± 0.03 (positive MDL increase of +0.90), indicating that the backfiring effect on final MDL is smaller for Swin than for ConvNeXt. However, the learning curves in Figure 13 reveal that Swin Transformers on QLEACE still exhibit the characteristic backfiring temporal signature β€” prolonged high loss in early epochs followed by sharp recovery β€” even though the integrated MDL remains above the control. For MLPs (Table 16), QLEACE produces a substantial positive MDL increase: 11.41 Β± 0.00 vs. 7.14 Β± 0.05 control (+4.27 bits per sample), the largest increase of any method, confirming that MLPs cannot exploit the injected higher-order information.

The temporal dynamics of backfiring. The loss curves in Figures 12 and 13 reveal how backfiring unfolds, not just that it occurs. Figure 12 shows ConvNeXt V2 training on CIFAR-10 (various widths and depths). QLEACE (orange curves) consistently starts with the highest loss of any method in early epochs (epochs 2⁰ through roughly 2⁴, i.e., epochs 1–16). At the base model size (width=40, depth=2, top-left panel), the QLEACE loss is approximately 2.5–3.0 bits per sample at epoch 2¹–2Β³, substantially above LEACE (roughly 2.0–2.5), gradient-based (roughly 2.0–2.5), ALF-QLEACE (roughly 2.0), and the control (roughly 1.5–2.0). Then, between epochs ~2⁴ and ~2⁡ (roughly epochs 16–32), a sharp transition occurs: QLEACE loss plummets, crossing below all other methods and ultimately converging to a final loss substantially below the control. This pattern β€” early struggle, sharp transition, eventual superiority β€” is consistent across all ConvNeXt configurations shown. At width=64, depth=2, the effect is even more pronounced, with QLEACE reaching a final loss near 1 bit per sample compared to roughly 1.5 for the control. Figure 13 shows the analogous curves for Swin Transformers, where QLEACE also shows the early high-loss period and sharp transition, but the final loss remains comparable to or slightly above the control rather than substantially below β€” explaining why the integrated MDL is positive even though backfiring occurs.

Dataset and architecture dependence of backfiring. Figure 8 reveals that backfiring on MLPs is dataset-specific. On SVHN (top row), QLEACE produces positive MDL increases across all widths (roughly 3–6 bits per sample) and depths (roughly 2–6 bits per sample) β€” no backfiring. On CIFARNet (bottom row), however, QLEACE produces negative MDL increases at several width-depth configurations. For width scaling (bottom-left, orange curve), the MDL increase dips to roughly -1 to -2 bits per sample at widths around 500–1000, and for depth scaling, MDL increase is negative (roughly -1 to 0) at depths 2–4. This demonstrates that backfiring can occur even in simple feedforward architectures when the dataset's statistical structure allows the injected higher-order information to be learnable by MLPs. CIFARNet apparently has higher-order structure that, after QLEACE transformation, becomes more accessible to MLPs than the original features, while SVHN and CIFAR-10 (for MLPs) do not.

Comparison across quadratic methods in the MLP setting. Figure 5 shows the MDL increase for all three quadratic methods on ReLU, GELU, and SwiGLU MLPs on CIFAR-10. QLEACE (orange curves) consistently produces the largest MDL increase across all widths, depths, and activation functions β€” roughly 2–6 bits per sample for ReLU, 1–4 for GELU, and 2–5 for SwiGLU. Gradient-based erasure (green) produces intermediate increases β€” roughly 2–4 for ReLU, 1–3 for GELU, 1–4 for SwiGLU. ALF-QLEACE (blue) produces the smallest increases β€” roughly 1–3 for ReLU, 0.5–2 for GELU, 1–2 for SwiGLU. The ordering QLEACE > Gradient > ALF-QLEACE in MDL increase magnitude holds robustly across activation functions and scaling dimensions, though the absolute magnitudes differ. This ordering makes sense given the methods' theoretical properties: QLEACE removes all quadratic information (but injects higher-order signals); gradient-based erasure aggressively minimizes moment differences but leaves residual accessible information; ALF-QLEACE only partially removes quadratic information through projections. For MLPs on CIFAR-10, the injection effect of QLEACE does not outweigh the removal of usable quadratic information β€” hence QLEACE is the most effective slower of learning among the three, despite being "dangerous" on other architectures.

Gradient-Based Quadratic Erasure Slows Learning Without Backfiring but Is Less Effective Than QLEACE on Feedforward Networks

The gradient-based method achieves its primary design goal: no backfiring across any architecture or dataset, while still increasing MDL relative to unerased controls. On ConvNeXt V2 (Figure 3, bottom right), gradient-based erasure produces consistently positive MDL increases of roughly 1–4 bits per sample across widths 40–65, avoiding the negative values that QLEACE exhibits. On Swin Transformers (Figure 7, bottom right), gradient-based erasure produces MDL increases of roughly 1–4 bits per sample. On MLPs (Figure 5), gradient-based erasure yields increases of roughly 2–4 bits per sample (ReLU), 1–3 (GELU), and 1–4 (SwiGLU). Table 16 confirms: ConvNeXt V2 on gradient-erased data achieves MDL of 5.37 Β± 0.02 vs. 5.09 Β± 0.09 control (+0.28), Swin V2 achieves 9.29 Β± 0.06 vs. 8.18 Β± 0.03 (+1.11), MLPs achieve 10.02 Β± 0.08 vs. 7.14 Β± 0.05 (+2.88), and LeNets achieve 8.71 Β± 0.09 vs. 5.62 Β± 0.02 (+3.09). All are positive β€” no backfiring.

However, the gradient-based method is systematically less effective than QLEACE at slowing learning on feedforward architectures. On MLPs (Figure 5), QLEACE consistently achieves 1–3 bits per sample higher MDL increase than gradient-based erasure across all widths and depths. This is a surprising result: QLEACE, which theoretically removes all quadratic information, should be at least as effective as gradient-based erasure at slowing learning if quadratic information removal is what matters. The fact that gradient-based erasure β€” which directly optimizes pixel values to minimize moment differences, potentially achieving near-zero quadratic information β€” is less effective suggests that either (1) the gradient-based optimization gets stuck in local minima where residual quadratic information remains accessible, or (2) QLEACE's class-dependent transformations create additional learning obstacles (beyond mere quadratic information removal) that MLPs struggle with, even before they can exploit the injected higher-order signals. The paper favors interpretation (1) in Section 4: "This disparity suggests that partial quadratic information may remain accessible even after aggressive gradient-based editing. These findings highlight potential limitations in gradient-based methods."

The loss curves for gradient-based erasure (Figures 9–15, green curves) show a consistent pattern: loss starts higher than the control but lower than QLEACE in early epochs, then converges to a final loss intermediate between the control and LEACE. There is no sharp transition β€” loss decreases smoothly and monotonically, consistent with a dataset that has genuinely reduced (but not eliminated) usable features, without any injected higher-order signals for the network to suddenly discover.

ALF-QLEACE Acts as Unintended Data Augmentation, Producing Lower MDL Than LEACE on Convolutional Architectures

The headline finding for ALF-QLEACE is paradoxical: despite applying LEACE as its first step (removing all linear information) and then additionally removing the principal directions of covariance discrepancy, ALF-QLEACE produces lower MDL than LEACE alone on convolutional architectures. This means that removing more information (quadratic on top of linear) makes learning easier, not harder.

Figure 3 (right panel, bottom) shows this clearly for ConvNeXt V2 on CIFAR-10. ALF-QLEACE (blue curve) produces MDL increases of roughly 0–2 bits per sample across widths 40–65, while LEACE (left panel, bottom) produces increases of roughly 1–2 bits per sample β€” the ALF-QLEACE values are lower than the LEACE values at nearly every width. At width ~48, ALF-QLEACE even dips near zero (no increase over the control), while LEACE remains at roughly +1.5 bits per sample. Table 16 (bottom) quantifies this for base model sizes: ConvNeXt V2 achieves MDL of 4.92 Β± 0.05 on ALF-QLEACE vs. 5.20 Β± 0.15 on LEACE β€” a reduction of 0.28 bits per sample despite ALF-QLEACE having LEACE as a sub-operation. For Swin V2, ALF-QLEACE achieves 8.67 Β± 1.20 vs. 9.00 Β± 0.13 for LEACE β€” a smaller but directionally consistent reduction of 0.33 bits per sample (though the large standard error on ALF-QLEACE for Swin, Β±1.20, makes this difference less reliable). For LeNets, ALF-QLEACE achieves 6.83 Β± 0.11 vs. 6.59 Β± 0.28 for LEACE β€” a small increase of 0.24 bits per sample, indicating the augmentation effect is architecture-specific.

The augmentation hypothesis is that by removing the directions along which classes differ most in variance, ALF-QLEACE effectively performs a partial covariance normalization β€” reducing the condition number of the optimization landscape and making gradient descent more efficient. This is conceptually similar to how z-score normalization or batch normalization accelerates training, not by removing information but by making the remaining information more accessible to first-order optimization. If this hypothesis is correct, then pre-normalizing the data (applying z-score normalization before erasure) should reduce or eliminate the gap between ALF-QLEACE and LEACE, since the normalization would already have handled the variance discrepancies that ALF-QLEACE's projection removes. The paper tests this with z-score normalization experiments on CIFAR-10 (Table 16, top, and Figure 16). The results are described as producing "ambiguous results" (Section 4): Figure 16 (top) shows that normalization "appreciably reduces MDL on linearly erased data, resulting in a lower mean MDL than for approximately quadratically erased data." The bottom table shows that with z-score normalization, ALF-QLEACE on MLPs achieves MDL of 8.94 Β± 0.14, which is higher than LEACE's 8.49 Β± 0.10 β€” the augmentation effect on MLPs disappears under explicit normalization, consistent with the hypothesis that ALF-QLEACE's benefit came from implicit normalization that is redundant when explicit normalization is applied. However, on ConvNeXt V2, ALF-QLEACE still achieves 4.92 vs. 5.20 for LEACE even with z-score normalization, suggesting the augmentation effect on ConvNeXts is not fully explained by variance normalization alone β€” perhaps the removal of specific covariance directions interacts favorably with ConvNeXt's architectural inductive biases (local receptive fields, hierarchical feature extraction) in ways beyond simple condition number improvement.

Comparison across datasets and architectures for ALF-QLEACE. The augmentation effect is clearly architecture-dependent. On MLPs (Figure 5), ALF-QLEACE produces MDL increases of roughly 1–3 bits per sample across widths and activation functions β€” positive, but lower than LEACE's increase (roughly 2–4 bits per sample in Figure 4) and substantially lower than QLEACE's. On CIFARNet and SVHN (Figure 8), ALF-QLEACE produces MDL increases that are positive but again smaller than LEACE on MLPs. The consistent pattern is that ALF-QLEACE's additional quadratic erasure (beyond LEACE) does not add to the learning difficulty β€” it either leaves difficulty unchanged or reduces it β€” across all architectures and datasets. This is strong evidence that the method is not actually removing information that networks rely on for learning, and may instead be making the remaining information more learnable.

Interpretation through the lens of the loss curves. Figures 9–15 show that ALF-QLEACE (blue curves) typically tracks LEACE (purple) closely in early epochs, sometimes with slightly lower loss, and converges to a final loss comparable to or slightly lower than LEACE. There is no sharp transition or anomalous behavior β€” ALF-QLEACE-edited data behaves like a slightly easier version of LEACE-edited data. This smooth behavior is consistent with a dataset that has had some variance directions removed (making optimization slightly easier) without having any new information injected (no backfiring signature) and without fully removing usable quadratic features.

Width and Depth Scaling Reveal That Erasure Effects Are Robust to Model Scale

The paper's scaling experiments (Figures 3–8) use Β΅P to test whether larger models can overcome erasure. The central finding for LEACE is that increasing width does not reduce the MDL gap between erased and unerased data β€” and in many cases increases it. For ReLU MLPs on CIFAR-10 (Figure 3, top left), the MDL increase from LEACE rises from roughly 2 bits per sample at width 64 to roughly 4 bits per sample at width 2048 β€” a doubling of the relative difficulty. This means wider networks find LEACE-edited data harder, not easier, relative to unerased data. If erasure merely removed some features that wider networks could compensate for with additional capacity, the MDL increase would shrink with width; the fact that it grows suggests LEACE removes a signal that is fundamentally necessary β€” class-conditional means β€” and that wider networks, with their greater capacity to fit noise or spurious correlations, may actually suffer more from its absence because they have more parameters that need meaningful signal to converge efficiently.

Depth scaling shows a more mixed pattern. For ReLU MLPs (Figure 4, bottom left), the MDL increase from LEACE is roughly 2–4 bits per sample across depths 1–8 with a slight upward trend. For GELU MLPs (bottom middle), the increase is roughly 2–3 bits per sample and relatively flat. For SwiGLU MLPs (bottom right), the increase is roughly 2–4 bits per sample with some non-monotonicity. No activation function shows a decrease in MDL increase with depth β€” deeper networks never overcome linear erasure.

For quadratic erasure on MLPs (Figure 5), the width scaling shows QLEACE's MDL increase growing with width (roughly 4–10 bits per sample at width 2048), gradient-based erasure growing modestly (roughly 3–5 bits per sample at width 2048), and ALF-QLEACE remaining relatively flat (roughly 2–4 bits per sample). Depth scaling shows all quadratic methods' MDL increases mostly flat or slightly declining with depth, with QLEACE showing some decline at depths 6–8 for GELU and SwiGLU β€” a possible sign that very deep networks begin to find ways around QLEACE's transformations, though the effect is not large enough to reverse the sign of the MDL increase.

For ConvNeXts and Swin Transformers (Figures 6 and 7), the width ranges are narrower (40–65 for ConvNeXt, 32–128 for Swin) due to computational constraints, so less can be said about asymptotic scaling. The available data shows relatively flat scaling for LEACE on both architectures (Figure 6) and more variable scaling for quadratic methods (Figure 7), with QLEACE's MDL increase oscillating between negative and positive values across ConvNeXt widths (the backfiring regime) and remaining positive but variable for Swin.

The infinite-width limit interpretation. The paper explicitly connects these findings to the feature-learning infinite-width limit (Yang & Hu, 2020; Vyas et al., 2024):

"Since we use the maximal update parametrization (Yang et al., 2021) to ensure hyperparameter transfer across network widths, this suggests LEACE makes learning more difficult even for infinite width feature-learning networks."

This claim is supported by the monotonic or flat scaling of MDL increase with width under Β΅P. If finite-width networks cannot overcome the erasure and the trend does not point toward zero MDL increase as width grows, the infinite-width extrapolation (which Β΅P is designed to enable) suggests that even infinite-width feature-learning networks would be affected. This is a strong theoretical claim: it implies that class-conditional mean differences are not merely one of many redundant features that overparametrized models can substitute for, but are a genuinely necessary component of efficient learning β€” at least for the architectures and datasets studied.

Dataset Comparisons Show CIFARNet Is Uniquely Susceptible to Backfiring Even in MLPs

Figure 8 provides the key cross-dataset comparison for MLPs. On SVHN (top row), QLEACE produces substantial positive MDL increases (roughly 3–6 bits per sample) across all widths and depths β€” no backfiring. Gradient-based erasure produces increases of roughly 2–4 bits per sample, and ALF-QLEACE produces increases of roughly 0.5–2 bits per sample. The ordering is QLEACE > Gradient > ALF-QLEACE > LEACE (with LEACE shown in the left panels, achieving roughly 0.5–1.5 bits per sample). This is the "well-behaved" regime where quadratic erasure successfully adds difficulty beyond linear erasure.

On CIFARNet (bottom row), the picture changes dramatically. QLEACE (orange curve in the bottom-right panel) produces negative MDL increases at multiple width and depth configurations β€” dipping to roughly -1 to -2 bits per sample at widths around 500–1000 and depths 2–4. Gradient-based erasure also dips to near-zero or slightly negative at some widths. ALF-QLEACE produces small positive increases. This is backfiring in MLPs β€” a result that appears only on CIFARNet and not on CIFAR-10 or SVHN. The paper notes (Section 4):

"Additionally, backfiring occurs in all two- and three-layer MLPs on the CIFARNet dataset, suggesting that even simple networks are able to access the injected higher order information in some datasets."

The CIFARNet dataset (Belrose et al., 2024) was specifically designed for studying distributional simplicity bias, and its statistical structure apparently creates conditions where QLEACE's injected higher-order information is learnable even by simple MLPs. The paper does not provide a detailed characterization of what makes CIFARNet different β€” its class-conditional distributions, its higher-order moment structure, or the nature of the QLEACE transformation applied to it β€” but the result serves as an important existence proof: backfiring is not exclusive to state-of-the-art vision architectures. Even a 2-layer ReLU MLP can discover and exploit the injected information if the dataset's structure makes it accessible.

Control comparison across datasets. The absolute MDL values for unerased data (Figure 8, black dashed lines or control curves) differ across datasets: CIFAR-10 MLPs achieve roughly 7 bits per sample (Table 16), SVHN MLPs achieve roughly 1.5–2.5 bits per sample (Figure 9, lower overall loss values on the y-axes), and CIFARNet MLPs appear to achieve intermediate values. SVHN is apparently an easier dataset for MLPs (digits on a relatively uniform background), which may explain why erasure has proportionally larger effects β€” when the original task is easy, removing a major signal source (class means) creates a larger relative increase in difficulty.

Ablation Studies and Robustness Checks

Activation function: The comparison across ReLU, GELU, and SwiGLU MLPs (Figures 4 and 5) tests whether the choice of nonlinearity mediates erasure effects. For linear erasure, all three activation functions show qualitatively identical patterns: positive MDL increase growing with width and relatively flat with depth. The magnitudes differ slightly (ReLU shows the largest increases, roughly 2–4 bits per sample; GELU shows roughly 2–3; SwiGLU shows roughly 2–4), but no activation function enables the network to overcome LEACE. For quadratic erasure, the same ordering (QLEACE > Gradient > ALF-QLEACE) holds across all activations, and no activation function produces backfiring for MLPs on CIFAR-10. The paper notes that "ReLU-based MLPs tend to be more affected at greater depths, and GeLU-based MLPs and SwiGLUs in shallow settings" (Section 4), visible in Figure 5 where QLEACE's depth curve for ReLU (bottom-left) rises to roughly 4–5 bits per sample at depth 8 while GELU (bottom-middle) remains at roughly 2–3 and SwiGLU (bottom-right) at roughly 2–4. This interaction between activation function and depth-dependent erasure efficacy is not theoretically explained but suggests that the precise geometry of the loss landscape β€” which depends on activation choice β€” affects how much the absence of quadratic features impedes learning.

Model width in the infinite-width limit: As discussed above, the width scaling experiments under Β΅P serve as an implicit ablation testing whether overparametrization can substitute for erased features. For LEACE, the answer is clearly no β€” MDL increase grows with width. For QLEACE on MLPs, MDL increase also grows with width (Figure 5, top rows), suggesting wider networks do not overcome the quadratic erasure on CIFAR-10. For QLEACE on ConvNeXts (Figure 3, bottom right), the width scaling is non-monotonic with negative values, making it difficult to assess whether infinite-width ConvNeXts would eventually overcome backfiring β€” the backfiring itself dominates the signal. This ablation would benefit from wider ConvNeXt sweeps (beyond width 65) to see if the backfiring regime stabilizes or changes, but computational constraints prevented this.

Model depth: The depth scaling experiments (Figures 4–8, bottom panels) test whether deeper networks, with additional nonlinear transformations, can reconstruct erased information through hierarchical feature extraction. For LEACE, MDL increase is largely flat or slightly increasing with depth β€” deeper networks do not recover linear information. For quadratic erasure on MLPs (Figure 5, bottom), QLEACE shows some decline in MDL increase at depths 6–8, particularly for GELU and SwiGLU, but the effect remains positive (>1 bit per sample) and does not cross zero. For ConvNeXts and Swins (Figures 6 and 7, bottom), the depth ranges are limited (2–4 for ConvNeXt, 2–8 for Swin), and the patterns are noisy with no clear depth-dependent recovery. The paper does not find evidence that depth systematically overcomes erasure.

Choice of erasure method (within quadratic erasure): The comparison of QLEACE, ALF-QLEACE, and gradient-based erasure on the same architectures and datasets is the central "method ablation." The key findings are: (1) QLEACE is most effective at slowing learning on MLPs but backfires on ConvNeXts and Swin Transformers; (2) gradient-based erasure never backfires but is less effective than QLEACE on MLPs; (3) ALF-QLEACE is the least effective across all architectures and sometimes reduces difficulty relative to LEACE alone. This ablation demonstrates that how quadratic information is removed matters enormously β€” the three methods produce qualitatively different learning dynamics despite sharing the same high-level goal.

Z-score normalization (Table 16, top; Figure 16): This ablation tests whether pre-normalizing pixel values (subtract mean, divide by standard deviation, computed per pixel coordinate across the training set) interacts with erasure methods. The paper reports that normalization "appreciably reduces MDL on linearly erased data, resulting in a lower mean MDL than for approximately quadratically erased data" β€” i.e., on z-scored data, LEACE becomes less effective and ALF-QLEACE becomes relatively more effective. Figure 16 (top) shows ReLU MLP MDL on z-scored CIFAR-10: the control is roughly 7 bits per sample, LEACE is roughly 8.5, ALF-QLEACE is roughly 9, gradient-based is roughly 10, and QLEACE is roughly 11.5. Compare to the non-normalized results where QLEACE achieves 11.41 (Table 16, bottom) β€” the presence of normalization does not substantially change QLEACE's effect but does reduce LEACE's (from roughly +1.35 to roughly +1.35 relative to z-scored control, though direct comparison is confounded by different control MDLs). The paper describes these results as "ambiguous" (Section 4) and does not draw strong conclusions, likely because the normalization changes the baseline difficulty and the erasure effects in ways that are not fully separable.

Dataset choice (CIFAR-10 vs. CIFARNet vs. SVHN): The three-dataset comparison (Figure 8 and associated loss curves) serves as an ablation over data distribution. The key finding is that backfiring in MLPs occurs only on CIFARNet, not on CIFAR-10 or SVHN, while backfiring in ConvNeXts occurs on CIFAR-10 (SVHN and CIFARNet are not tested with ConvNeXts or Swin Transformers). This demonstrates that backfiring is not purely a property of the architecture or purely of the dataset, but an interaction between the two. The paper does not characterize what specific property of CIFARNet makes it susceptible, which limits the generalizability of this finding.

Random projection visual comparison (Figure 1): The inclusion of a random projection of equal rank to ALF-QLEACE in the qualitative visualization serves as a sanity check: ALF-QLEACE's effect on image appearance is more structured than random projection β€” it produces specific distortions (visible as a "smearing" or selective blurring of the ship image) rather than complete noise. This supports the interpretation that ALF-QLEACE is doing something semantically meaningful (removing specific variance directions) rather than just destroying information uniformly. However, no learning experiments are run with random projections as a baseline, so the quantitative effect of random vs. targeted projection on MDL is unknown.

Critical Assessment

Claim: "LEACE consistently slows learning" β€” What the Experiments Actually Show

The experiments unambiguously demonstrate that LEACE increases MDL across all tested architectures, widths, depths, and datasets. Figure 3 (left panels), Figure 4, Figure 6, Figure 8, and Table 16 all show positive MDL increases β€” there is not a single configuration where LEACE makes learning easier than the unerased control. This is the strongest and most robust claim in the paper, and the evidence fully supports it.

However, "consistently slows learning" could mean several things, and the experiments test only some of them. The paper demonstrates that applying LEACE to all three datasets (CIFAR-10, CIFARNet, SVHN) increases MDL for MLPs; that it does so for ConvNeXt V2 and Swin V2 on CIFAR-10; and that the effect persists under width and depth scaling. What is not tested: (1) LEACE on datasets beyond these three image classification benchmarks β€” text, tabular, or other modalities might have different mean structures where LEACE is either trivially easy to circumvent (e.g., if class means are already equal) or impossible to apply (e.g., discrete data); (2) LEACE with stronger data augmentation β€” the paper uses only random crops and horizontal flips, both of which are linear transformations that cannot reintroduce mean differences, but more aggressive augmentations (color jitter, CutMix, MixUp) could potentially create new mean differences during training that partially undo the erasure; (3) LEACE with very long training β€” the schedule-free optimizer trains "until convergence," but what counts as convergence may differ between architectures and datasets, and it's possible that extremely long training (orders of magnitude more epochs) would allow networks to eventually discover higher-order features that compensate for the missing means, reducing the MDL gap.

The claim that LEACE works "even for infinite width feature-learning networks" is an extrapolation, not a direct empirical finding. The width sweeps go up to 2048 for MLPs and ~65–128 for ConvNeXts and Swins β€” far from infinite. Β΅P provides theoretical justification for extrapolating trends to wider networks, but the extrapolation assumes the observed trend (MDL increase growing or stable with width) continues monotonically. This is plausible but not proven.

Claim: "Quadratic erasure can backfire, with QLEACE making learning easier than unerased data" β€” What the Experiments Actually Show

The evidence for backfiring is strong but conditional. The clearest case is ConvNeXt V2 on QLEACE-edited CIFAR-10: Table 16 shows MDL of 1.67 vs. 5.09 control (a massive reversal), and Figure 12 shows the characteristic temporal signature of early struggle followed by sharp transition and eventual superiority. This is a genuine, unambiguous case of backfiring β€” the erasure made the data substantially easier to learn.

The Swin Transformer case is weaker: Table 16 shows QLEACE MDL of 9.08 vs. 8.18 control β€” a positive increase, not a reversal. The backfiring on Swins is visible only in the learning dynamics (early high loss, sharp transition, final loss comparable to control) and in the MDL being lower than LEACE (9.08 vs. 9.00). The integrated MDL does not cross below the control. Whether this "counts" as backfiring depends on the definition: if backfiring means "final MDL lower than control," Swin does not backfire; if it means "erasure injects recoverable higher-order information that the network eventually exploits, partially or fully undoing the intended slowdown," the Swin case qualifies.

The MLP backfiring on CIFARNet (Figure 8) is genuine β€” MDL increase becomes negative at some width/depth configurations β€” but it is limited to a single dataset and not characterized in detail. The paper does not report final MDL values for CIFARNet with QLEACE (only MDL increases relative to control), so the magnitude of the reversal is unclear. The paper also does not provide learning curves for CIFARNet to confirm that the temporal signature matches what is seen on CIFAR-10 with ConvNeXts.

Unanswered questions about backfiring: What specific higher-order features are being exploited? The paper provides a geometric intuition (characteristic hyperparallelepipeds) but no empirical verification β€” no probing experiments, no visualization of the learned features, no analysis of which network layers detect the injected information. Without such analysis, backfiring remains a phenomenon that is observed but not explained. Are ConvNeXts detecting the affine transformation parameters directly? Are they detecting boundary effects at the edges of the transformed hyperparallelepipeds? Are they detecting artifacts of the matrix square root computation (numerical precision issues creating subtle patterns)? The paper doesn't distinguish between these possibilities.

Claim: "ALF-QLEACE sometimes acts as data augmentation, making learning easier than LEACE" β€” What the Experiments Actually Show

The evidence is clear for ConvNeXt V2 on CIFAR-10: Table 16 shows ALF-QLEACE MDL of 4.92 vs. LEACE's 5.20, a reduction of 0.28 bits per sample. For Swin V2, the reduction is 0.33 bits per sample but with ALF-QLEACE's standard error of Β±1.20 β€” the difference is not statistically significant given the reported uncertainty. For MLPs, ALF-QLEACE MDL (8.94) is higher than LEACE (8.49) on z-scored data but potentially lower on non-z-scored data (the paper does not report a direct non-z-scored LEACE vs. ALF-QLEACE comparison for MLPs in a single table). For LeNets, ALF-QLEACE (6.83) is slightly higher than LEACE (6.59). The augmentation claim therefore holds firmly only for ConvNeXt V2.

The paper's explanation β€” that ALF-QLEACE partially normalizes the covariance matrix, acting like data augmentation β€” is a post-hoc hypothesis, not a tested mechanism. To test it, one would need to compare ALF-QLEACE to explicit covariance normalization (e.g., ZCA whitening, or simply removing the top principal components of the class-conditional covariance differences and measuring MDL). The z-score normalization experiment is a partial test: if ALF-QLEACE's benefit comes from variance normalization, then explicitly normalizing the data should reduce or eliminate that benefit. The paper reports "ambiguous results" from this experiment, which weakens the augmentation hypothesis. A cleaner ablation would be: compare LEACE + random projection (removing the same number of dimensions as ALF-QLEACE but randomly) vs. LEACE + ALF-QLEACE projection, to isolate whether the specific directions removed by ALF-QLEACE (high-variance-difference directions) are what cause the augmentation effect, or whether any dimensionality reduction after LEACE has a similar effect.

Claim: "Wider networks do not overcome LEACE" β€” What the Experiments Actually Show

The width scaling evidence (Figures 3, 4, 6) shows that MDL increase grows or remains stable with width for MLPs and ConvNeXts on CIFAR-10. The growth in MDL increase with width for MLPs (from ~2 to ~4 bits per sample) actually suggests wider networks are hurt more by LEACE than narrow ones β€” the opposite of "overcoming" the erasure. This is an interesting and somewhat counterintuitive finding: one might expect that wider networks, with more parameters, could learn to extract higher-order features that compensate for missing means, but the data shows they struggle more.

However, the width range for ConvNeXts (40–65) and Swins (32–128) is narrow. A ~2–3Γ— scaling of width is insufficient to make strong claims about asymptotic behavior. For MLPs, the 64β†’2048 sweep (~32Γ— width scaling) is more convincing, but even this is far from the "infinite width" limit that Β΅P theory addresses. The claim that LEACE works "even for infinite width feature-learning networks" is a theoretical interpretation of the scaling trend, not a direct empirical finding. To strengthen it, one would want to see the MDL increase curve flatten out or continue growing to the maximum tested width, with no sign of inflection toward zero β€” which is generally what the figures show, but the data is noisy and the extrapolation is necessarily uncertain.

Missing Experiments That Would Strengthen the Paper

Several experiments would significantly improve the generalizability and mechanistic understanding of the results:

Probing for injected information. The paper claims QLEACE injects higher-order Shannon information about the class label, but never directly measures this. A simple test: train a linear classifier on random nonlinear features (e.g., random Fourier features or a frozen randomly-initialized network's representations) of QLEACE-edited data, and compare its accuracy to the same classifier on LEACE-edited data. If QLEACE injects higher-order information that is linearly separable in some expanded feature space, this would be detectable. Alternatively, measure the mutual information (or a proxy like nearest-neighbor classification accuracy) between QLEACE-edited images and class labels, compared to LEACE-edited images.

Architecture-controlled probing of backfiring. To understand what about ConvNeXt V2 makes it susceptible to backfiring while MLPs are not (on CIFAR-10), one could do an architecture ablation: test ConvNeXt without skip connections, without normalization layers, with different kernel sizes, or with different depths, to isolate which architectural component enables the detection of injected higher-order features. Similarly, testing vision transformers (ViT) without the hierarchical/swin structure would clarify whether the effect is specific to ConvNeXts or general to modern vision architectures.

Layer-wise analysis of learned representations. For models that exhibit backfiring, analyzing the representations at different layers during the "transition period" (epochs 16–32 for ConvNeXt) could reveal when and where the network begins encoding the injected higher-order information. Centered Kernel Alignment (CKA) or linear probing at each layer would show whether the information appears abruptly in specific layers (consistent with the sharp transition in loss) or gradually throughout the network.

Direct comparison of QLEACE and gradient-based erasure on the same moment-matching objective. The paper hypothesizes that gradient-based erasure is less effective because residual quadratic information remains. This could be tested by measuring the actual class-conditional moment differences after gradient-based editing and comparing them to QLEACE's (which are exactly zero by construction). If gradient-based erasure achieves moment differences close to zero but still produces lower MDL than QLEACE on MLPs, the information injection explanation would be strengthened (QLEACE adds difficulty beyond mere moment equalization). If gradient-based erasure has non-negligible residual moment differences, the explanation would lean toward incomplete erasure.

Random projection baseline for ALF-QLEACE. To test whether ALF-QLEACE's reduction in MDL (relative to LEACE) is due to the specific directions it removes or simply due to dimensionality reduction, one could compare ALF-QLEACE to LEACE + random projection of the same rank. If random projection also reduces MDL, the effect is about dimensionality reduction generally (fewer dimensions = less capacity needed = easier optimization). If only ALF-QLEACE reduces MDL, the effect is about the specific variance directions being removed.

Longer training and wider sweeps for ConvNeXt and Swin. The backfiring phenomenon might have a richer dependence on model scale than the current width sweeps can reveal. Training ConvNeXts up to width ~200 and Swins up to width ~256, with enough epochs to see whether the backfiring transition time changes with scale, would clarify whether backfiring is a finite-width artifact or an asymptotic phenomenon.

Conditional Claims and Their Precise Boundaries

"LEACE consistently slows learning" holds for the tested architectures (ReLU/GELU/SwiGLU MLPs, ConvNeXt V2, Swin V2), datasets (CIFAR-10, CIFARNet, SVHN), and training regimes (Β΅P, schedule-free AdamW, standard data augmentation, training to convergence). The claim's generality to other architectures, datasets, modalities, or training paradigms is untested.

"QLEACE backfires on ConvNeXt V2" holds for CIFAR-10 with z-score normalization at the tested widths and depths. It is untested on SVHN, CIFARNet, or with non-normalized data for ConvNeXt (Table 16 reports only z-scored results for ConvNeXt). The claim's generality to other convolutional architectures or other datasets is untested.

"ALF-QLEACE acts as data augmentation on ConvNeXt V2" holds for CIFAR-10 with z-scored data β€” the MDL is 4.92 vs. 5.20 for LEACE. The effect is small (0.28 bits per sample) and may not be statistically significant (no test is reported). Its generality to non-convolutional architectures is not supported β€” MLP and LeNet results show ALF-QLEACE with higher MDL than LEACE.

6. Limitations and Trade-offs

The Z-Score Normalization Interaction Makes Cross-Dataset Comparisons Ambiguous β€” And the Normalized/Unnormalized Results Point in Different Directions

The assumption or constraint. The paper runs experiments both with and without z-score normalization of pixel values (subtracting the per-pixel mean and dividing by the per-pixel standard deviation across the training set), but does so inconsistently across architectures. Table 16 (bottom) reports final MDL values for all architectures on z-scored CIFAR-10, while the width/depth sweeps in Figures 3–8 appear to use non-normalized data (the paper does not explicitly specify normalization status for each figure, but the MDL magnitudes in Figure 4–6 for MLPs on CIFAR-10 differ from the z-scored values in Table 16). The paper acknowledges the ambiguity in Section 4:

"We examined whether z-score normalizing the CIFAR-10 dataset before erasure affected the relative increase in MDL, with ambiguous results (Table 16)."

Figure 16 (top) shows that on z-scored CIFAR-10, LEACE produces lower MDL than ALF-QLEACE for ReLU MLPs β€” a reversal of the pattern on non-normalized data where ALF-QLEACE's MDL is closer to or below LEACE's. The paper describes normalization as "appreciably reducing MDL on linearly erased data, resulting in a lower mean MDL than for approximately quadratically erased data."

The consequence. The ambiguity is not cosmetic β€” it cuts to the core of how one should interpret the main results. If z-score normalization changes whether LEACE is more or less effective than quadratic methods for MLPs, then the "erasure difficulty" ordering is not a property of the concepts being erased but a joint property of the erasure and the data preprocessing pipeline. A practitioner who normalizes their data before applying erasure may get qualitatively different results from someone who does not. Moreover, the fact that normalization reduces the effectiveness of LEACE (making linear erasure less potent) while leaving QLEACE's effect roughly unchanged suggests that normalization interacts with first-order statistics differently than with second-order statistics β€” a finding that is observed but not explained, and that makes it impossible to state a simple, preprocessing-independent rule for which erasure method to use.

The cross-architecture Table 16 (bottom) reports only z-scored results, while the main width/depth sweeps appear to use non-normalized data. This means the paper's central claim about ConvNeXt backfiring (MDL of 1.67 for QLEACE vs. 5.09 control) is established only on z-scored data, while the claim that QLEACE is most effective on MLPs (MDL increase of ~4–10 bits per sample) comes from non-normalized sweeps. The reader cannot directly compare these numbers or know whether ConvNeXt backfiring would be more or less severe without normalization.

What evidence exists in the paper. Table 16 (top) and Figure 16 provide the only z-scored vs. non-z-scored comparison, but only for ReLU MLPs and only at base model sizes. Figure 16 (top) shows MDL vs. width for z-scored CIFAR-10 with ReLU MLPs: control β‰ˆ 7 bits, LEACE β‰ˆ 8.5, ALF-QLEACE β‰ˆ 9, gradient β‰ˆ 10, QLEACE β‰ˆ 11.5. Compare this to Figure 3 (top-left, non-normalized): control β‰ˆ 2.5–3 bits, LEACE increase β‰ˆ 2–4 bits. The absolute MDL values differ dramatically (7 vs. 2.5 for control) because normalization changes the loss scale. The relative ordering also differs: on z-scored data, ALF-QLEACE > LEACE (9 vs. 8.5); on non-normalized data, ALF-QLEACE < LEACE in some regimes (Figure 3 suggests ALF-QLEACE increases are smaller than LEACE's for MLPs, though a direct side-by-side is not provided). The paper does not reconcile these differences.

Mitigation status. The paper does not resolve the ambiguity. It reports the normalization experiment, describes the results as "ambiguous," and moves on. The authors do not provide a unified recommendation about whether normalization should be applied before erasure, nor do they characterize how normalization changes the statistical properties that erasure targets (e.g., normalization equalizes per-pixel variances across the dataset, which partially removes second-order information before QLEACE is even applied β€” potentially reducing QLEACE's incremental effect). Future work would need to systematically vary preprocessing and erasure order, measure the resulting moment equalization, and determine which combinations produce reliable slowing of learning. The current paper flags the issue but does not resolve it.

QLEACE Requires Full-Rank Class-Conditional Covariance Matrices β€” And the Paper Does Not Discuss Regularization When This Fails

The assumption or constraint. The QLEACE transformation formula (Theorem 2.6, Equation 8) requires computing $\Sigma_i^{-1/2}$ for each class-conditional covariance matrix. This requires each $\Sigma_i$ to be invertible β€” i.e., full rank β€” which in turn requires that the number of samples per class exceeds the data dimensionality, or that the data does not lie in a lower-dimensional subspace. For CIFAR-10 images, the raw pixel dimensionality is $d = 32 \times 32 \times 3 = 3072$. With 5,000 training examples per class, the empirical covariance is singular or near-singular β€” the number of samples is only ~1.6Γ— the dimensionality, and image pixels are highly correlated, meaning the effective rank is much lower than 3072.

The paper never discusses this issue. Section 2.2 states the theorem assumes "full rank covariance matrices $\Sigma_1, \ldots, \Sigma_k$" and Theorem 2.6 is proven for $\Sigma \in \mathcal{S}^d_{++}$ (the set of symmetric positive definite matrices). There is no mention of regularization, pseudoinverses, dimensionality reduction before erasure, or any other practical technique for handling singular covariances. The authors must have applied some form of numerical stabilization (e.g., adding a small constant to the diagonal, $\Sigma_i + \epsilon I$, before computing the inverse square root), but this is not documented.

The consequence. Without documented regularization, QLEACE is not reproducible from the paper alone. A practitioner attempting to implement QLEACE on their own dataset will encounter a matrix inversion failure and have no guidance on how to proceed. The choice of regularization strength $\epsilon$ is not a minor implementation detail β€” it directly controls a tradeoff. Too small an $\epsilon$, and the matrix square root computation becomes numerically unstable or fails entirely. Too large an $\epsilon$, and the "whitening" step $\Sigma_i^{-1/2}$ no longer accurately removes the class-conditional covariance structure β€” it instead shrinks all directions uniformly, blending the quadratic erasure with isotropic noise injection. This means the headline guarantee ("all classes have equal means and covariances after QLEACE") holds only approximately in practice, with the approximation quality depending on an undocumented regularization parameter.

The problem is more severe for datasets with higher dimensionality or fewer samples per class. QLEACE's theoretical appeal β€” that it provides a closed-form, provably minimal-distortion quadratic erasure β€” depends on the Gaussian optimal transport theory, which assumes non-singular covariances. When this assumption is violated (as it is for all three datasets in the paper), the method becomes an approximation with no characterized error bounds.

What evidence exists in the paper. None. The paper provides no implementation details about covariance regularization, no ablation over regularization strength, and no measurement of how close the regularized QLEACE transformation comes to achieving the theoretical moment equalization guarantee. The fact that QLEACE-edited data produces extreme results (ConvNeXt MDL of 1.67 vs. 5.09 control) suggests the transformation is doing something dramatic to the data, but whether that dramatic effect is the intended quadratic erasure or an artifact of aggressive regularization (e.g., an $\epsilon$ large enough that the transformation primarily injects noise or creates the characteristic hyperparallelepipeds through numerical artifacts rather than genuine optimal transport) is unknown.

Mitigation status. Not addressed. The paper does not acknowledge the full-rank assumption as a practical limitation, does not describe how it was handled in experiments, and does not discuss the sensitivity of results to regularization choices. This is a gap between the theoretical derivation (which is clean and well-presented) and the empirical application (which necessarily involves undisclosed numerical workarounds). A reader cannot assess whether QLEACE "works" in the sense of achieving its stated mathematical objective, or whether the empirical results reflect the behavior of a regularized approximation whose properties differ from the theory.

The Difficulty Estimation Problem Is Avoided Rather Than Solved β€” There Is No Characterization of Which Datasets or Problems Will Exhibit Backfiring

The assumption or constraint. The paper demonstrates that QLEACE backfires on some architecture-dataset combinations (ConvNeXt on CIFAR-10, MLPs on CIFARNet) but not on others (MLPs on CIFAR-10 and SVHN). However, it provides no diagnostic, no predictive criterion, and no measurement that would allow a practitioner to determine before running the experiment whether QLEACE will backfire on their specific dataset and architecture. The paper's own characterisation of why backfiring occurs β€” that class-dependent affine transformations map each class to a "characteristic hyperparallelepiped" whose shape encodes class identity β€” is a post-hoc geometric intuition, not a testable condition.

The paper does not measure any property of the QLEACE-edited data that correlates with backfiring: the mutual information between edited images and class labels, the accuracy of a non-neural classifier (e.g., kernel SVM) on the edited data, the distance between the characteristic hyperparallelepipeds, or the magnitude of higher-order moment differences introduced by the transformation. Without such measurements, the paper's central cautionary message β€” "do not use quadratic erasure because it can backfire" β€” leaves the practitioner unable to determine whether their use case falls in the backfiring regime or the well-behaved regime.

The consequence. The paper's practical recommendation boils down to: "LEACE is safe; quadratic erasure is risky." But this is an unhelpfully binary conclusion when the experiments show that QLEACE is the most effective slower of learning on MLPs with CIFAR-10 and SVHN β€” precisely the regime where one might want to use quadratic erasure. If QLEACE works well on MLPs but backfires on ConvNeXts, a practitioner training an MLP on a non-image dataset cannot confidently use QLEACE because the paper provides no way to know whether their dataset is CIFAR-10-like (safe) or CIFARNet-like (backfires even on MLPs).

The paper also provides no guidance on how to detect backfiring if it occurs. The characteristic signature β€” prolonged high loss followed by a sharp transition β€” is visible only in hindsight after training for many epochs. A practitioner who stops training early (because the initial high loss suggests erasure is working) would never observe the backfire and might erroneously conclude that QLEACE successfully slowed learning. Conversely, a practitioner who trains to convergence might observe the backfire but have already expended the compute budget, making the detection useful only for post-hoc analysis, not for decision-making.

What evidence exists in the paper. The paper documents that backfiring occurs on specific configurations (Figures 3, 7, 8, 12, 13; Table 16) but does not measure why those configurations differ from the non-backfiring cases. The CIFARNet backfiring result (Figure 8) is particularly suggestive β€” it shows that backfiring in MLPs is dataset-dependent β€” but the paper does not characterize what property of CIFARNet makes it susceptible. The only comparative statement is that CIFARNet is a synthetic dataset "designed for studying distributional simplicity bias" (Belrose et al., 2024), which tells the reader nothing actionable.

Mitigation status. The paper acknowledges the existence of backfiring as a phenomenon and implicitly recommends avoiding quadratic erasure (Section 5: "we urge practitioners to exercise caution when applying them in practice"). It does not develop a diagnostic, a detection method, or a theoretical condition for predicting backfiring. The suggestion of ALF-QLEACE as a backfire-free alternative is partially undermined by ALF-QLEACE's own failure mode (acting as unintended data augmentation and reducing MDL relative to LEACE on ConvNeXts). The paper thus leaves practitioners with three quadratic erasure options β€” one that can backfire (QLEACE), one that can accelerate learning (ALF-QLEACE), and one that is computationally expensive and less effective than QLEACE on MLPs (gradient-based) β€” and no principled way to choose among them.

The Computational Cost of Producing Erased Datasets Is Substantial and Completely Unaccounted For

The assumption or constraint. The paper's evaluation framework treats erasure as a one-time preprocessing step whose cost is external to the learning difficulty measurement. The MDL metric captures only the cost of training on the already-erased data; it does not include the FLOPs, wall-clock time, or memory required to compute the erasure transformations themselves. This is acknowledged implicitly by the paper's structure (erasure is described in Section 2 as mathematical derivations, not as algorithms with complexity analysis), but the practical costs are never quantified.

The consequence. The computational costs of the three quadratic methods differ by orders of magnitude, and for some methods, the erasure cost may dominate the training cost β€” making the headline MDL comparisons misleading about total resource requirements.

For QLEACE, the dominant cost is solving the fixed-point equation for the Wasserstein barycenter covariance $\bar{\Sigma}$ (Lemma 2.4, Equation 4). Each iteration requires computing $k$ matrix square roots of $d \times d$ matrices (where $d = 3072$ for CIFAR-10), each costing $O(d^3)$ β€” roughly $3 \times 10^{10}$ floating-point operations per square root. The fixed-point iteration of Álvarez-Esteban et al. (2016) may require tens or hundreds of iterations to converge. After the barycenter is computed, each class requires a matrix square root and matrix multiplication for the optimal transport map (Equation 8). The total cost for CIFAR-10 is likely in the range of $10^{12}$–$10^{13}$ FLOPs β€” comparable to training a small neural network for several epochs. For higher-resolution images (e.g., 224Γ—224 ImageNet, $d = 150,528$), the $O(d^3)$ scaling makes QLEACE computationally intractable without dimensionality reduction.

For gradient-based erasure, the cost is dominated by the L-BFGS optimization over all training image pixels simultaneously. For CIFAR-10, this means optimizing $50,000 \times 3072 \approx 1.5 \times 10^8$ scalar variables. Each L-BFGS iteration requires computing the loss function (involving moment estimation over the entire dataset) and its gradient with respect to all pixels. The paper does not report the number of L-BFGS iterations used, but moment matching to near-zero discrepancy likely requires many iterations. For larger datasets, this approach scales poorly: the optimization variable count grows linearly with dataset size, making it infeasible for datasets with millions of images.

For ALF-QLEACE, the cost is lower β€” it requires computing class-conditional covariance matrices ($O(k \cdot n \cdot d^2)$ for $n$ samples per class), singular value decompositions of the difference matrices ($O(d^3)$ per iteration of the projection removal), and applying the projection ($O(d^2)$ per datapoint). This may still be substantial but is the cheapest of the three quadratic methods.

What evidence exists in the paper. None. The paper reports no timing benchmarks, no FLOP counts, and no discussion of how the methods scale with data dimensionality or dataset size. The gradient-based method is described as using L-BFGS, but no iteration count, convergence criterion, or wall-clock time is provided. The QLEACE barycenter computation is described as using the algorithm from Álvarez-Esteban et al. (2016), but no convergence behavior or iteration count for the datasets studied is reported.

Mitigation status. Not addressed. The authors do not discuss the computational cost of erasure as a factor in method selection, do not compare the preprocessing cost to the training cost, and do not provide guidance on which method is most cost-effective for a given compute budget. This is a significant gap for a paper whose practical contribution is a recommendation about which erasure method to use: if QLEACE is 100Γ— more expensive to compute than LEACE but provides only a modest additional slowdown in learning (and risks backfiring), a practitioner might reasonably choose LEACE on cost-effectiveness grounds alone, even without the reliability concerns. The paper provides no data to inform such a decision.

The Study Is Limited to Small Image Classification Benchmarks with No Evidence of Generalization to Other Modalities, Tasks, or Scales

The assumption or constraint. All experiments use three datasets of 32Γ—32 images (CIFAR-10, CIFARNet, SVHN) with exactly 10 classification categories each. The paper draws general conclusions about concept erasure β€” "LEACE is a reliable method for making features less salient and more difficult to learn" (Section 5) β€” based entirely on this narrow domain. There are no experiments on:

  • Larger images (e.g., ImageNet at 224Γ—224), where the curse of dimensionality for covariance estimation is far more severe ($d \approx 150,000$ vs. $3,072$) and QLEACE would require dimensionality reduction or regularization of a magnitude that may fundamentally change the method's behavior.
  • Text or tabular data, where the notion of "moments" applies differently (discrete tokens for text, mixed categorical/continuous variables for tabular data) and the optimal transport theory underlying QLEACE (which assumes Gaussian distributions or at least distributions where the $W_2$ optimal map is affine) may be a poor approximation.
  • Tasks beyond classification, such as regression, structured prediction, or generative modeling, where the concept erasure target is not a discrete class label but a continuous or structured variable.
  • Class counts beyond 10, where the Wasserstein barycenter involves more distributions and the fixed-point equation may have different convergence properties.
  • Larger training sets, where gradient-based erasure becomes prohibitively expensive and QLEACE's $O(d^3)$ per-iteration cost may dominate.

The paper's authors acknowledge, in the impact statement, broad applicability β€” "concept erasure methods can be used to enhance the fairness of deep learning models by making sensitive information, like gender or race, less salient" β€” but provide no evidence that the methods studied here behave reliably in such settings.

The consequence. The paper's practical recommendations may not transfer to the settings where concept erasure is most needed. Fairness applications typically involve high-dimensional data (images of faces, text documents) with sensitive attributes that are often binary (gender) or multi-class (race) but may have complex, non-Gaussian class-conditional distributions. The finding that QLEACE backfires on expressive architectures is particularly concerning for fairness: if a fairness practitioner applies QLEACE to remove gender information from face embeddings, and the downstream classifier is a ConvNeXt or transformer, the paper's results suggest the erasure might actually make gender easier to recover by injecting higher-order artifacts. The practitioner has no way to know whether their specific combination of data modality, architecture, and sensitive attribute falls in the backfiring regime because the paper provides no out-of-distribution test.

The narrow scope also means the paper's positive result β€” that LEACE consistently slows learning β€” might not generalize. LEACE removes class-conditional mean differences. On CIFAR-10, where classes have visually distinct mean images (the average "airplane" looks different from the average "automobile"), this removes a major learning signal. On a dataset where class means are already similar (e.g., fine-grained classification where classes differ only in texture or local shape patterns, not overall brightness or color distribution), LEACE might have a negligible effect β€” the network was never relying on mean differences anyway. The paper provides no characterization of when mean differences are a significant fraction of the learnable signal, which limits the generalizability of the LEACE recommendation.

What evidence exists in the paper. The three datasets were chosen to span different data distributions (natural images, synthetic images, street-view digits), and the paper does show some dataset-dependent variation (CIFARNet backfires for MLPs while SVHN does not). This within-domain variation is valuable but does not substitute for cross-domain testing. The ConvNeXt and Swin experiments use only CIFAR-10, so there is no evidence about whether the backfiring phenomenon on modern architectures generalizes across datasets within the image domain, let alone to other modalities.

Mitigation status. The paper does not claim to have tested beyond image classification and does not extrapolate its findings to other modalities. Section 5's recommendation to use LEACE and avoid quadratic erasure is presented as a general conclusion, not a domain-specific one, but the evidence base is domain-specific. The paper does not discuss what properties of image data (spatial correlation, bounded pixel values, translation invariance) might make these results domain-dependent, nor does it suggest caution about extrapolation to other modalities. Future work would need to replicate the core experiments on text embeddings, tabular data, or other domains to establish whether the reliability ordering (LEACE > gradient-based > ALF-QLEACE β‰ˆ QLEACE in terms of safety) is universal or image-specific.

The Paper Provides No Formal Statistical Analysis β€” Standard Errors Are Reported but Not Used to Qualify Claims About Relative Performance

The assumption or constraint. The experimental results are reported as mean Β± standard error across 5 random seeds for each configuration. The paper uses these standard errors in tables (Table 16) but not in figures (Figures 3–8 show only means and smoothed curves), and never performs hypothesis tests, computes confidence intervals for differences between methods, or corrects for multiple comparisons. Claims about one method producing "higher" or "lower" MDL than another are based on visual comparison of point estimates and trend lines, without formal statistical evaluation.

The consequence. Several of the paper's claimed effect sizes are small relative to the reported uncertainty, making it unclear whether they are reliable or due to seed variation. The central finding that ALF-QLEACE acts as data augmentation on ConvNeXt V2 β€” a key piece of evidence for the "quadratic erasure is unreliable" narrative β€” relies on a difference of 0.28 bits per sample between ALF-QLEACE (4.92 Β± 0.05) and LEACE (5.20 Β± 0.15) in Table 16. The standard error on LEACE is Β±0.15, meaning the two means are separated by approximately 1.8 standard errors of the LEACE estimate. This is suggestive but not conclusive without a formal test β€” and the ALF-QLEACE advantage for Swin Transformers (8.67 Β± 1.20 vs. 9.00 Β± 0.13) is even weaker given the large ALF-QLEACE standard error.

Similarly, the ordering of quadratic methods for MLPs in Figure 5 β€” which shows QLEACE > Gradient > ALF-QLEACE in MDL increase β€” relies on comparing curves whose error bars are not shown. If the seed-to-seed variance is large (as the Β±1.20 on Swin ALF-QLEACE suggests it can be), the visual ordering may not hold under formal testing. The paper's conclusion that QLEACE is "most effective" on MLPs would be strengthened by showing that the QLEACE–Gradient difference is statistically significant across the width/depth range, but no such analysis is provided.

The 5-seed protocol, while standard in deep learning experiments, may be insufficient when the quantity of interest is a difference between two noisy training trajectories (each MDL value integrates loss over many epochs of a single training run). The MDL for a given run is itself a random variable (dependent on initialization, data order, and optimization stochasticity), and 5 samples provide limited power to detect differences of the magnitude reported (0.1–0.3 bits per sample for some ALF-QLEACE vs. LEACE comparisons).

What evidence exists in the paper. Standard errors are reported in Table 16 and mentioned in the figure captions ("MDL over 5 random seeds"). The paper does not report p-values, confidence intervals for differences, effect sizes with uncertainty, or any correction for the large number of implicit comparisons being made across the many (architecture Γ— width Γ— depth Γ— eraser) configurations. The loss curves in Figures 9–15 show per-seed variation visually (multiple curves per condition), but the MDL summary figures (3–8, 16) collapse this to means only.

Mitigation status. Not addressed. The paper does not discuss statistical power, does not justify the choice of 5 seeds, and does not qualify its claims based on the magnitude of uncertainty relative to effect sizes. The conclusions are presented as qualitative findings supported by the experiments, without formal statistical backing. For a paper whose primary contribution is an empirical demonstration that quadratic erasure methods are unreliable, the strength of this demonstration depends on whether the observed differences between methods are larger than the experimental noise. For some claims (e.g., QLEACE backfires dramatically on ConvNeXt, with MDL of 1.67 vs. 5.09 control β€” a 3.4 bit gap that is many standard errors wide), the effect is clearly beyond noise. For others (e.g., the relative ordering of ALF-QLEACE and LEACE on different architectures), the evidence is more fragile and would benefit from formal analysis or larger seed counts.

7. Implications and Future Directions

How This Work Changes the Landscape

This paper reconfigures the concept erasure landscape by establishing that the clean theoretical framework that made linear erasure reliable β€” minimal-distortion optimal transport to a shared target distribution β€” does not extend gracefully to higher-order moments. The implicit assumption that quadratic erasure would be "LEACE but for covariances" β€” same guarantees, same reliability, just a harder math problem β€” turns out to be false in a way that is conceptually instructive rather than merely inconvenient.

The shift is not a paradigm overthrow, but a sharp diagnostic contribution: the paper identifies and names a specific failure mode (backfiring) that any future concept erasure method must address, and provides the evaluation methodology (prequential MDL over full training trajectories) needed to detect it. Prior to this work, a concept erasure researcher could reasonably believe that removing all quadratically available information would, by definition, make learning harder β€” since you're taking away signal. The paper demonstrates that this intuition is wrong when the erasure transformation is class-dependent: you can remove signal from the moments you control while injecting signal into the moments you don't, and the net effect can be to accelerate learning. This is not an implementation bug in QLEACE β€” it's a structural property of any method that applies different affine transformations to different classes.

The practical consequence is a recalibration of trust in concept erasure methods. Before this paper, LEACE was one tool among many; after this paper, LEACE is the only tool with demonstrated architecture-independent reliability. Quadratic erasure moves from "promising but technically challenging" to "unreliable and potentially counterproductive." This is a significant narrowing of the usable toolbox, and it will shift research attention toward understanding why the linear-to-quadratic extension breaks rather than toward developing cubic or higher-order erasure methods (which would presumably suffer from even more severe information injection).

The paper also reconciles a latent tension in the distributional simplicity bias literature. Belrose et al. (2024) showed that networks can learn from low-order statistics early in training, but left open the question of whether removing those statistics would actually prevent learning. The LEACE results provide a clean answer: removing first-order statistics consistently slows learning across architectures, and the slowdown persists (or grows) with model scale β€” evidence that class-conditional means are not merely available but are genuinely necessary for efficient learning under gradient-based optimization. The quadratic erasure results complicate the story: removing second-order statistics has unpredictable effects, suggesting that the relationship between moment availability and learnability is not monotonic. Networks can learn from higher-order statistics when lower-order ones are removed, but whether they do so depends on architecture, dataset, and the specific transformation used β€” a finding that complicates any simple "networks learn statistics in order of complexity" narrative.

Methodologically, the paper establishes prequential MDL as the right metric for concept erasure evaluation. The standard approach in prior work β€” probing classifiers, mutual information estimation, or final test accuracy β€” would have missed backfiring entirely. A linear probe on QLEACE-edited data might show chance-level accuracy (since means and covariances are equalized), incorrectly suggesting successful erasure. Final test accuracy might show improved performance, suggesting erasure failed β€” but without revealing the temporal dynamics (prolonged struggle, sharp transition) that are the signature of information injection. MDL captures the full trajectory and makes backfiring visible as a distinct phenomenon. Future concept erasure work should adopt this metric as standard, and papers that claim successful erasure based only on endpoint metrics should be viewed with appropriate skepticism.

The research directions that become more attractive after this paper:

  • Understanding and preventing information injection in concept erasure (the core unsolved problem).
  • Developing erasure methods that work at the representation level rather than the data level, where class-dependent transformations can be applied without creating "characteristic hyperparallelepipeds" in input space.
  • Training verifier or critic models to detect when concept erasure has failed (analogous to the verifier over-optimization literature, but for data preprocessing).
  • Investigating why convolutional architectures are particularly susceptible to detecting injected higher-order information β€” is it the local receptive fields, the hierarchical feature extraction, or something else?

The research directions that become less attractive:

  • Developing cubic or higher-order moment erasure methods. If quadratic erasure already backfires due to information injection, higher-order methods would likely inject even more recoverable structure. The theoretical extension is straightforward (the polynomial predictor framework in Theorems 2.2 and 2.3 generalizes to any order N), but the practical value is nil until the injection problem is solved.
  • Searching for a "better QLEACE" β€” a different optimal transport map or a different target distribution β€” without addressing the class-dependence issue. The information injection is a structural consequence of per-class transformations, not a suboptimality of the specific barycenter target.
  • Applying quadratic erasure in safety-critical fairness applications. The paper's results suggest that QLEACE-edited data can make sensitive attributes easier to recover on expressive architectures β€” the opposite of the intended effect. Until the conditions for backfiring are well-characterized, using quadratic erasure for bias mitigation is unsafe.

Follow-Up Research This Work Enables

Training a lightweight "backfiring detector" model to predict whether a given dataset-erasure-architecture combination will exhibit information injection. The paper identifies backfiring as a critical failure mode but provides no way to predict it without running the full experiment. A practical next step: take the QLEACE-edited datasets from this paper (CIFAR-10, CIFARNet, SVHN), extract features from the edited images (e.g., higher-order moment statistics, distance to class-specific hyperparallelepiped boundaries, or representations from a frozen pretrained network), and train a classifier to predict whether a given (dataset, architecture) pair will backfire based on properties of the edited data alone. The training signal: the paper's own results, which provide ground-truth backfiring labels for ~20 configurations (ConvNeXt on CIFAR-10: yes; MLP on CIFAR-10: no; MLP on CIFARNet: yes for some widths; etc.). If such a detector works, it would give practitioners a cheap pre-training check; if it fails, that would demonstrate that backfiring depends on training dynamics in ways not predictable from static data properties, which is itself a valuable finding.

Characterizing exactly what higher-order features ConvNeXts exploit during QLEACE backfiring through layer-wise probing and feature visualization. The paper provides a geometric intuition β€” characteristic hyperparallelepipeds β€” but no empirical evidence about what the network actually learns. A strong follow-up would replicate the ConvNeXt V2 on QLEACE-edited CIFAR-10 experiment (the cleanest backfiring case, with MDL dropping from 5.09 to 1.67), save checkpoints before and after the sharp loss transition at ~epoch 16, and perform: (1) linear probing of each layer's representations to predict the class label, to identify when in the network the injected information becomes accessible; (2) feature visualization (e.g., optimization-based or activation maximization) of the representations that discriminate classes in the post-backfire network, to see whether they correspond to the affine transformation parameters (shear directions, scaling factors) that QLEACE applied; (3) ablation of specific architectural components (skip connections, normalization layers, kernel sizes) to isolate which inductive biases enable backfiring. If the network is literally learning to invert the QLEACE transform and read out which class-specific affine map was applied, this would confirm the information injection hypothesis at a mechanistic level; if it's learning something else entirely (e.g., boundary artifacts at the edges of the transformed hypercube), that would refine our understanding of what "injected higher-order information" actually means in practice.

Testing whether the backfiring phenomenon generalizes to representation-level erasure, where the stakes for fairness applications are highest. The paper applies erasure directly to pixels β€” input-space transformations. In fairness applications, concept erasure is typically applied to learned representations (e.g., the penultimate layer of a face recognition network) rather than raw inputs. Do class-dependent quadratic transformations of representation vectors also create characteristic geometric artifacts that downstream classifiers can exploit? A direct experiment: take a pretrained ResNet or ConvNeXt on CelebA or a similar face dataset, extract representation vectors for images with binary gender labels, apply QLEACE to those vectors (making the class-conditional means and covariances equal in representation space), then train a simple linear classifier or shallow MLP on the QLEACE'd representations. If the classifier achieves above-chance accuracy despite the moment equalization β€” and especially if its learning curve shows the early-struggle-then-sharp-transition backfiring signature β€” this would demonstrate that the problem extends to the setting where concept erasure is most commonly deployed. If, by contrast, representation-space QLEACE does not backfire (perhaps because representation vectors are less constrained than pixels and the "characteristic hyperparallelepiped" effect is weaker), this would bound the scope of the paper's warning and suggest that quadratic erasure may still be viable for representation-level fairness interventions.

Developing a regularized QLEACE that constrains the transformation's deviation from identity to trade off quadratic erasure against information injection. The paper shows that QLEACE's class-dependent affine transformations are both the source of its erasure power and the cause of its backfiring. An obvious middle ground: constrain each class's transformation matrix $A_i$ (the $\Sigma_i^{-1/2}(\Sigma_i^{1/2}\bar{\Sigma}\Sigma_i^{1/2})^{1/2}\Sigma_i^{-1/2}$ term) to be close to the identity matrix by adding a penalty $\lambda \|A_i - I\|_F^2$ to the barycenter objective. As $\lambda \to \infty$, the transformation reduces to pure translation (i.e., LEACE); as $\lambda \to 0$, it recovers full QLEACE. By sweeping $\lambda$ on CIFAR-10 with ConvNeXt V2 and measuring both the residual covariance discrepancy and the MDL, one could map out the Pareto frontier between erasure completeness and backfiring risk. This would provide practitioners with a tunable knob: for safety-critical applications, use high $\lambda$ (safe, weaker erasure); for applications where backfiring is unlikely (MLPs on non-CIFARNet-like data), use low $\lambda$ (stronger erasure). The experiment would also test whether backfiring onset is gradual (MDL smoothly decreases as $\lambda$ decreases) or sharp (a phase transition at a critical $\lambda$ value), which would inform theoretical models of the phenomenon.

Measuring whether the "data augmentation" effect of ALF-QLEACE is genuinely about variance normalization by comparing against explicit covariance preconditioning baselines. The paper hypothesizes that ALF-QLEACE reduces MDL relative to LEACE because its projection removes high-variance directions, acting like implicit batch normalization or ZCA whitening. This is testable: compare LEACE + ALF-QLEACE projection against (a) LEACE + random projection of the same rank, (b) LEACE + ZCA whitening to unit covariance, and (c) LEACE + removing the top principal components of the combined data (PCA projection, which removes variance directions regardless of class-conditional structure). If ALF-QLEACE's MDL reduction matches ZCA whitening or PCA projection, the augmentation hypothesis is supported and the effect is about optimization conditioning. If ALF-QLEACE uniquely reduces MDL while random projection and ZCA do not, the effect is specifically about removing class-conditional variance discrepancies β€” and something about that removal genuinely makes the remaining features more learnable. This experiment would also clarify whether ALF-QLEACE should be recommended as a data preprocessing technique (independent of concept erasure) for improving ConvNeXt training efficiency on certain datasets.

Evaluating LEACE's reliability boundary by testing it on datasets where class-conditional means are already similar, to determine when linear erasure stops working. The paper shows LEACE consistently slows learning on CIFAR-10, CIFARNet, and SVHN β€” datasets where different classes have visibly different average images. What about fine-grained classification datasets (e.g., CUB-200 birds, Stanford Cars) where class means are similar because all classes share the same general appearance, differing only in subtle texture and shape features? If LEACE is applied to such a dataset and produces negligible MDL increase, this would reveal that the method's effectiveness depends on the effect size of mean differences in the original data β€” an obvious point, but one the paper does not quantify. Conversely, if LEACE still substantially slows learning even when class means are similar, that would suggest the method is removing something more subtle about the mean structure (perhaps the means of intermediate representations learned early in training) that is universally important. This experiment would define the scope of "LEACE is reliable" β€” is it reliable when it matters (i.e., when sensitive attributes have large mean differences that enable discrimination), or is it reliable in an absolute sense across all datasets? The paper's current claim leans toward the latter, but the evidence is drawn entirely from datasets where mean differences are substantial.

Practical Applications and Downstream Use Cases

Fairness interventions that require erasing sensitive attributes from data before model training. The most direct application is preprocessing datasets to remove information about protected attributes before training downstream classifiers. The paper provides clear guidance: use LEACE, not quadratic erasure. LEACE is the only method that consistently increases learning difficulty across architectures without backfiring. A practitioner working with, say, a hiring dataset where they want to remove gender information from resume embeddings before training a job-fit classifier can apply LEACE to the embeddings (subtract gender-conditional means, add back the global mean) with confidence that this will make gender linearly unusable and will not inadvertently inject recoverable gender information. The paper's width-scaling results (Figure 3) provide the additional assurance that even if the downstream model is very large (wide MLP or ConvNeXt), the erasure will not be circumvented by overparametrization β€” the MDL increase from LEACE grows or remains stable with width, never shrinks. The caveat is that this guidance is validated only on image classification; a fairness practitioner working with text or tabular data should verify LEACE's reliability in their domain before deployment, but the paper provides the evaluation protocol (prequential MDL, multiple seeds, sweep architectures) to do so.

Data augmentation through controlled variance removal for improving ConvNeXt training efficiency. The unexpected finding that ALF-QLEACE reduces MDL relative to LEACE on ConvNeXt V2 (Table 16: 4.92 vs. 5.20 bits per sample) suggests a practical use case that is the inverse of the paper's stated goal: rather than using ALF-QLEACE to slow learning, use it to accelerate learning by removing variance directions that impair optimization. A practitioner training ConvNeXts on CIFAR-10-scale datasets could apply ALF-QLEACE as a preprocessing step β€” compute the rank $d - k$ projection that removes the top directions of class-conditional covariance discrepancy, apply it to all images, and train with the same protocol. The paper's results suggest this would reduce final MDL by ~0.3 bits per sample relative to standard preprocessing β€” a modest but non-trivial gain that comes "for free" as a preprocessing step. The effect may be larger on datasets with more extreme variance discrepancies between classes. This application repurposes a concept erasure method as a data conditioning technique, and the paper's characterization of ALF-QLEACE as "unintended data augmentation" provides the theoretical motivation.

Synthetic data generation with controlled feature availability for studying learning dynamics. The paper's erasure methods provide a toolkit for creating datasets where specific orders of statistical information are absent. A researcher studying neural network learning dynamics could use LEACE to generate a dataset where only second-and-higher-order features are available, and QLEACE (on architectures where it doesn't backfire, like MLPs on CIFAR-10) to generate a dataset where only third-and-higher-order features are available. By training networks on these progressively "harder" datasets and comparing learning curves, one could test hypotheses about which statistical orders are necessary for efficient learning, how the time course of feature learning changes when lower-order statistics are absent, and whether different architectures have different "minimum required moment orders" for successful training. The paper's width and depth scaling under Β΅P provides a template for such experiments: use Β΅P to ensure fair scaling comparisons, schedule-free optimization to avoid confounding by learning rate schedules, and prequential MDL to capture full learning trajectories. The backfiring phenomenon itself becomes an interesting object of study in this context β€” a case where the network abruptly transitions from struggling to mastering the task, which could inform theories of grokking and phase transitions in neural network training.

Safety testing for concept erasure methods before deployment in high-stakes settings. The paper's evaluation framework β€” prequential MDL, multiple architectures, multiple seeds, full training trajectories β€” provides a template for vetting any new concept erasure method before it is used in fairness or safety applications. A team developing a new erasure technique can adopt this protocol as a standard test suite: apply the method to CIFAR-10 (or a domain-relevant benchmark), train at least one feedforward architecture (MLP) and one modern architecture (ConvNeXt or transformer), compute MDL over the full training curve, and check for (a) positive MDL increase relative to unerased control, (b) no sharp loss transitions late in training (backfiring signature), and (c) consistency across 5+ seeds. If a method passes these checks on the benchmark, it earns provisional trust for deployment; if it shows backfiring or architecture-dependent reversal, it is flagged as unsafe. The paper's own results provide the reference values: LEACE passes on all three datasets and architectures (MDL consistently elevated, no backfiring); QLEACE fails on ConvNeXt and CIFARNet MLPs; ALF-QLEACE shows the augmentation effect; gradient-based erasure passes but with weaker effect sizes. This testing protocol could become a standard part of the concept erasure development pipeline, analogous to how adversarial robustness evaluation is standard for defense methods.