Erased but Exploitable: Black-box Embedding-Aware Prompting Against Unlearned Text-to-Image Diffusion Models
BEAP is a black-box attack that uses a Large Language Model (LLM) to iteratively generate adversarial prompts against text-to-image models after they have been unlearned. It combines concept detection, image quality, and alignment scores to guide the LLM in creating natural, human-readable prompts that successfully bypass safety filters and recover the removed concepts.