← 研踪 PaperTrailarXiv:2611.10106 · v1
Beyond Prompt Attacks: Least-Action Auditing of Concept Erasure
首次提交 2026-11-07 02:18
版本更新 2026-11-07 02:18
雷达观测 2026-11-10 10:11
摘要
Concept erasure, or concept unlearning, in text-to-image diffusion models is usually audited with prompt attacks. A prompt attack tests whether one conditioning string still retrieves the erased concept. It does not measure the probability that the frozen generator still assigns to that concept. We introduce least-action auditing of this residual probability, and evaluate it on Stable Diffusion concept-erasure checkpoints. The least-action barrier is the minimum control cost of driving the frozen reverse process into a detector-defined concept event. This cost equals the path-space KL divergence of conditioning the model on the event, and therefore the event's negative log-probability. The estimate $ΔS_{\mathrm{rob}}$ uses a CLIP$\wedge$DINOv2 consensus terminal, with no retraining and no adversarial prompt. Across $18$ erased concept-mechanism pairs spanning object classes and NSFW nudity, $ΔS_{\mathrm{rob}}$ predicts deployment leakage counted on $1{,}500$ fresh samples per model by detectors excluded from the audit (pooled Spearman $ρ{=}{-}0.76$, $p{=}5{\times}10^{-4}$). Within every audited concept, the eraser with the higher barrier leaks less ($18/18$). On NSFW nudity the barrier orders the standard erasers exactly: UCE $ΔS_{\mathrm{rob}}{=}3.9$ (leak $16.4\%$) $<$ ESD $75.5$ ($9.8\%$) $<$ RECE $224.5$ ($1.4\%$), while Safe Latent Diffusion (SLD) stays near zero and leaks $85.5\%$ under explicit prompts. The same trajectories repair deployed checkpoints. An audit-guided closed-form patch reduces UCE nudity leakage from $16.2\%$ to $0/1{,}500$ and RECE church leakage by $3.3\times$, where direction-count-matched random edits fail.
作者备注：22 pages, 12 figures
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v1 · 2026-11-07 02:18 · 最新观测版本
Beyond Prompt Attacks: Least-Action Auditing of Concept Erasure
Concept erasure, or concept unlearning, in text-to-image diffusion models is usually audited with prompt attacks. A prompt attack tests whether one conditioning string still retrieves the erased concept. It does not measure the probability that the frozen generator still assigns to that concept. We introduce least-action auditing of this residual probability, and evaluate it on Stable Diffusion concept-erasure checkpoints. The least-action barrier is the minimum control cost of driving the frozen reverse process into a detector-defined concept event. This cost equals the path-space KL divergence of conditioning the model on the event, and therefore the event's negative log-probability. The estimate $ΔS_{\mathrm{rob}}$ uses a CLIP$\wedge$DINOv2 consensus terminal, with no retraining and no adversarial prompt. Across $18$ erased concept-mechanism pairs spanning object classes and NSFW nudity, $ΔS_{\mathrm{rob}}$ predicts deployment leakage counted on $1{,}500$ fresh samples per model by detectors excluded from the audit (pooled Spearman $ρ{=}{-}0.76$, $p{=}5{\times}10^{-4}$). Within every audited concept, the eraser with the higher barrier leaks less ($18/18$). On NSFW nudity the barrier orders the standard erasers exactly: UCE $ΔS_{\mathrm{rob}}{=}3.9$ (leak $16.4\%$) $<$ ESD $75.5$ ($9.8\%$) $<$ RECE $224.5$ ($1.4\%$), while Safe Latent Diffusion (SLD) stays near zero and leaks $85.5\%$ under explicit prompts. The same trajectories repair deployed checkpoints. An audit-guided closed-form patch reduces UCE nudity leakage from $16.2\%$ to $0/1{,}500$ and RECE church leakage by $3.3\times$, where direction-count-matched random edits fail.
查看此版本解读 →查看此版本原文 ↗