aiqbench analysis
This research exposes a critical vulnerability in text-to-image diffusion models where concept erasure techniques fail to remove latent backdoors, allowing adversaries to reactivate harmful content after unlearning attempts. The study demonstrates that even robust methods searching for alternative representations can be bypassed, with success rates reaching up to 94% for object erasure and significantly amplifying explicit content exposure. For practitioners, this finding underscores the necessity of rigorous stress-testing and diagnostic tools to verify that concept removal does not merely conceal but truly sever malicious associations.
Erased but Not Forgotten: How Backdoors Compromise Concept Erasure
arXiv:2504.21072v3 Announce Type: replace-cross Abstract: The expansion of text-to-image diffusion models has raised concerns about harmful outputs, from fabricated depictions of public figures to sexually explicit imagery. To mitigate such risks, prior work has proposed concept erasure methods that aim to sever unwanted concepts from the model via fine-tuning, yet it remains unclear whether these approaches truly remove all links to the harmful concept or merely conceal superficial connections. In this work, we reveal a critical vulnerability, the Erasure Evasion Backdoor (EEB): an adversary binds a backdoor trigger to a concept slated for removal, and this malicious link survives subsequent erasure. We show that both black-box and white-box adversaries can instantiate this threat. Across six state-of-the-art erasure methods, including robust ones that explicitly search for alternative representations of the target concept, EEB consistently exposes harmful content: up to 82% success against celebrity-identity unlearning, up to 94% for object erasure, and up to 16 times amplification of explicit-content exposure. While EEB uncovers a blind spot in current erasure methods, it also provides a diagnostic tool for stress-testing future concept erasure techniques.
Abstract:The expansion of text-to-image diffusion models has raised concerns about harmful outputs, from fabricated depictions of public figures to sexually explicit imagery. To mitigate such risks, prior work has proposed concept erasure methods that aim to sever unwanted concepts from the model via fine-tuning, yet it remains unclear whether these approaches truly remove all links to the harmful concept or merely conceal superficial connections. In this work, we reveal a critical vulnerability, the Erasure Evasion Backdoor (EEB): an adversary binds a backdoor trigger to a concept slated for removal, and this malicious link survives subsequent erasure. We show that both black-box and white-box adversaries can instantiate this threat. Across six state-of-the-art erasure methods, including robust ones that explicitly search for alternative representations of the target concept, EEB consistently exposes harmful content: up to 82% success against celebrity-identity unlearning, up to 94% for object erasure, and up to 16 times amplification of explicit-content exposure. While EEB uncovers a blind spot in current erasure methods, it also provides a diagnostic tool for stress-testing future concept erasure techniques.
Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Machine Learning (cs.LG)
arXiv:2504.21072 [cs.CR]
(or arXiv:2504.21072v3 [cs.CR] for this version)
Full text under the publisher's open licence · 193 words
Related coverage
Erased but Not Forgotten: How Backdoors Compromise Concept Erasure
arXiv · Oct 7, 2026
CleanVideo: Adaptive Concept Erasure for Text-to-Video Diffusion Models
arXiv · Sep 18, 2026
Hidden not Deleted: How Networks Suppress Entangled Features
arXiv · Sep 24, 2026
To Erase, or Not to Erase: Robust Training-Free Concept Erasure with Preservation aware Adaptive Ranked Subspace Expansion
arXiv · Jul 28, 2026