The Linear Geometry of Interpretable Tokens: Jailbreaking Attacks and Defenses for Unlearned Diffusion Models
The research found that harmful concepts are not fully erased from unlearned diffusion models but remain as a coherent linear subspace in their token embedding space. SubAttack reads this subspace using learned attack tokens, while SubDefense removes it by projecting out these attack vectors. This reveals that unlearning methods fail to eliminate deep semantic associations.