Concept Score Relearning: A Unified Cross-Architecture Attack on Concept Erasure
cs.CV
Submitted: 2026-09-27
Updated: 2026-09-27
Code: https://github.com/kakaobrain/coyo-dataset
License: http://creativecommons.org/licenses/by/4.0/
The gist: Concept erasure aims to suppress undesirable knowledge in text-to-image generative models.
Terminology
Abstract
Concept erasure aims to suppress undesirable knowledge in text-to-image generative models. However, existing robustness evaluations typically rely on relearning attacks tailored to specific model architectures. We study concept reactivation across two substantially different generative paradigms: noise-prediction U-Nets and flow-matching Transformers. We introduce Concept Score Relearning (CSR), a unified parameter-level framework that reactivates erased concepts by optimizing each model within its native prediction space. CSR requires no external target-concept image dataset and applies the same concept-directed objective to both U-Net-based Stable Diffusion and Transformer-based FLUX. Experiments across diverse concepts and multiple erasure methods demonstrate consistent concept reactivation across both architectures, highlighting the cross-architecture applicability of CSR and the persistent recoverability of apparently erased concepts. For strict nudity, CSR reaches average ASRs of 50.47% on FLUX and 40.29% on Stable Diffusion, consistently ranking first across all evaluated safety settings.
Sources
- Erasing Undesirable Concepts in Diffusion Models with Adversarial Preservation
- ConceptPrune: Concept Editing in Diffusion Models via Skilled Neuron Pruning
- Dynamic Optimization and Safety Indicator Injection for Jailbreaking Text-to-Image Models with Multimodal Safety Filters
- Prompting4Debugging: Red-Teaming Text-to-Image Diffusion Models by Finding Problematic Prompts
- HTS-Attack: Heuristic Token Search for Jailbreaking Text-to-Image Models
- Erased, But Not Forgotten: Erased Rectified Flow Transformers Still Remain Unsafe Under Concept Attack
- FLUX.1 Kontext: Flow Matching for In-Context Image Generation and Editing in Latent Space
- One Image is Worth a Thousand Words: A Usability Preservable Text-Image Collaborative Erasing Framework
- Erased or Dormant? Rethinking Concept Erasure Through Reversibility
- Image Can Bring Your Memory Back: A Novel Multi-Modal Guided Attack against Image Generation Model Unlearning
- Jailbreaking Prompt Attack: A Controllable Adversarial Attack against Diffusion Models
- Adversarial Attacks on Image Generation With Made-Up Words
- GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Models
- Multimodal Prompt Decoupling Attack on the Safety Filters in Text-to-Image Models
- Memory Self-Regeneration: Uncovering Hidden Knowledge in Unlearned Models
- MixBridge: Heterogeneous Image-to-Image Backdoor Attack through Mixture of Schr\"odinger Bridges
- Hierarchical Text-Conditional Image Generation with CLIP Latents
- Large-scale Classification of Fine-Art Paintings: Learning The Right Metric on The Right Feature
- RoFormer: Enhanced Transformer with Rotary Position Embedding
- Backdooring Textual Inversion for Concept Censorship
Related papers
- Loss Knows Best: Detecting Annotation Errors in Videos via Loss Trajectories
- AnchorWeave: World-Consistent Video Generation with Retrieved Local Spatial Memories
- Benchmarking the Robustness of Foundation Models for Mammography under Domain Shift
- MambaX-Net: Dual-Input Mamba-Enhanced Cross-Attention Network for Longitudinal MRI Segmentation
- TeleOCR: Navigating Document Parsing Across Digital and Camera-Captured Documents
- A Survey on Efficient Vision-Language-Action Models