mlsanityData to 7 Oct 2026

Concept Score Relearning: A Unified Cross-Architecture Attack on Concept Erasure

arXiv 2609.33445 ↗First posted 27 Sep 2026cs.CVcited by 0

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Concept erasure aims to suppress undesirable knowledge in text-to-image generative models. However, existing robustness evaluations typically rely on relearning attacks tailored to specific model architectures. We study concept reactivation across two substantially different generative paradigms: noise-prediction U-Nets and flow-matching Transformers. We introduce Concept Score Relearning (CSR), a unified parameter-level framework that reactivates erased concepts by optimizing each model within its native prediction space. CSR requires no external target-concept image dataset and applies the same concept-directed objective to both U-Net-based Stable Diffusion and Transformer-based FLUX. Experiments across diverse concepts and multiple erasure methods demonstrate consistent concept reactivation across both architectures, highlighting the cross-architecture applicability of CSR and the persistent recoverability of apparently erased concepts. For strict nudity, CSR reaches average ASRs of 50.47% on FLUX and 40.29% on Stable Diffusion, consistently ranking first across all evaluated safety settings.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 61 of its 69 references that are in the map. First posted on arXiv 27 Sep 2026.

Builds on

61 of 69 references.

Closest ancestors · 25

Same direction, newest first

  1. 2025Erased, But Not Forgotten: Erased Rectified Flow Transformers Still Remain Unsafe Under Concept Attack1 Oct
  2. 2025Image Can Bring Your Memory Back: A Novel Multi-Modal Guided Attack against Image Generation Model Unlearning9 Jul
  3. 2025Erased or Dormant? Rethinking Concept Erasure Through Reversibility22 May
  4. 2025One Image is Worth a Thousand Words: A Usability Preservable Text-Image Collaborative Erasing Framework16 May
  5. 2025MixBridge: Heterogeneous Image-to-Image Backdoor Attack through Mixture of Schr"odinger Bridges12 May
  6. 2024EraseAnything: Enabling Concept Erasure in Rectified Flow Transformers29 Dec
  7. 2024Memories of Forgotten Concepts1 Dec
  8. 2024Erasing Undesirable Concepts in Diffusion Models with Adversarial Preservation21 Oct
  9. 2024DiffZOO: A Purely Query-Based Black-Box Attack for Red-teaming Text-to-Image Generative Model via Zeroth Order Optimization18 Aug
  10. 2024ConceptPrune: Concept Editing in Diffusion Models via Skilled Neuron Pruning29 May
  11. 2024Probing Unlearned Diffusion Models: A Transferable Adversarial Attack Perspective30 Apr
  12. 2024Jailbreaking Prompt Attack: A Controllable Adversarial Attack against Diffusion Models2 Apr
13 more
  1. 2024MACE: Mass Concept Erasure in Diffusion Models10 Mar
  2. 2023MMA-Diffusion: MultiModal Attack on Diffusion Models29 Nov
  3. 2023To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy To Generate Unsafe Images ... For Now18 Oct
  4. 2023Ring-A-Bell! How Reliable are Concept Removal Methods for Diffusion Models?16 Oct
  5. 2023Prompting4Debugging: Red-Teaming Text-to-Image Diffusion Models by Finding Problematic Prompts12 Sep
  6. 2023Unified Concept Editing in Diffusion Models25 Aug
  7. 2023Backdooring Textual Inversion for Concept Censorship21 Aug
  8. 2023Stable Diffusion is Unstable5 Jun
  9. 2023Forget-Me-Not: Learning to Forget in Text-to-Image Diffusion Models30 Mar
  10. 2023A Pilot Study of Query-Free Adversarial Attack against Stable Diffusion29 Mar
  11. 2023Ablating Concepts in Text-to-Image Diffusion Models23 Mar
  12. 2023Erasing Concepts from Diffusion Models13 Mar
  13. 2022Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Models9 Nov

Other references · 36

  1. 2017Attention Is All You Needcited by 59,932
  2. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  3. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  4. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  5. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  6. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  7. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
  8. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,322
  9. 2021RoFormer: Enhanced Transformer with Rotary Position Embeddingcited by 4,581
  10. 2021Zero-Shot Text-to-Image Generationcited by 4,276
  11. 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,131
  12. 2024Scaling Rectified Flow Transformers for High-Resolution Image Synthesiscited by 4,094
24 more
  1. 2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,595
  2. 2021CLIPScore: A Reference-free Evaluation Metric for Image Captioningcited by 2,388
  3. 2021Conceptual 12M: Pushing Web-Scale Image-Text Pre-Training To Recognize Long-Tail Visual Conceptscited by 1,209
  4. 2022Diffusion Models: A Comprehensive Survey of Methods and Applicationscited by 1,107
  5. 2019Machine Unlearningcited by 1,020
  6. 2022Diffusion Models in Vision: A Surveycited by 1,008
  7. 2025FLUX.1 Kontext: Flow Matching for In-Context Image Generation and Editing in Latent Spacecited by 960
  8. 2025DanceGRPO: Unleashing GRPO on Visual Generationcited by 388
  9. 2015Large-scale Classification of Fine-Art Paintings: Learning The Right Metric on The Right Featurecited by 181
  10. 2022Can Machines Help Us Answering Question 16 in Datasheets, and In Turn Reflecting on Inappropriate Content?cited by 150
  11. 2025Set You Straight: Auto-Steering Denoising Trajectories to Sidestep Unwanted Conceptscited by 61
  12. 2022Adversarial Attacks on Image Generation With Made-Up Wordscited by 29
  13. 2023Discovering Failure Modes of Text-guided Diffusion Models via Adversarial Searchcited by 25
  14. 2024HTS-Attack: Heuristic Token Search for Jailbreaking Text-to-Image Modelscited by 14
  15. 2025Reason2Attack: Jailbreaking Text-to-Image Models via LLM Reasoningcited by 14
  16. 2025Token-Level Constraint Boundary Search for Jailbreaking Text-to-Image Modelscited by 9
  17. 2025PLA: Prompt Learning Attack against Text-to-Image Generative Modelscited by 8
  18. 2025AutoPrompt: Automated Red-Teaming of Text-to-Image Models via LLM-Driven Adversarial Promptscited by 6
  19. 2024Towards Privacy-Guaranteed Label Unlearning in Vertical Federated Learning: Few-Shot Forgetting without Disclosurecited by 5
  20. 2025Universally Unfiltered and Unseen:Input-Agnostic Multimodal Jailbreaks against Text-to-Image Model Safeguardscited by 5
  21. 2024Antelope: Potent and Concealed Jailbreak Attack Strategycited by 2
  22. 2025Multimodal Prompt Decoupling Attack on the Safety Filters in Text-to-Image Modelscited by 2
  23. 2025Memory Self-Regeneration: Uncovering Hidden Knowledge in Unlearned Modelscited by 2
  24. 2025ZIUM: Zero-Shot Intent-Aware Adversarial Attack on Unlearned Modelscited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025SAGE: Exploring the Boundaries of Unsafe Concept Domain with Semantic-Augment Erasing
  2. 2025EraseFlow: Learning Concept Erasure Policies via GFlowNet-Driven Alignment
  3. 2026Erasure or Erosion? Evaluating Compositional Degradation in Unlearned Text-To-Image Diffusion Models
  4. 2025Rethinking the Vulnerability of Concept Erasure and a New Method
  5. 2025Robust Concept Erasure in Diffusion Models: A Theoretical Perspective on Security and Robustness
  6. 2026TILDE: TILt-based Distributional Erasure for Concept Unlearning
  7. 2025M-ErasureBench: A Comprehensive Multimodal Evaluation Benchmark for Concept Erasure in Diffusion Models
  8. 2024Reliable and Efficient Concept Erasure of Text-to-Image Diffusion Models