TINA: Text-Free Inversion Attack for Unlearned Text-to-Image Diffusion Models

TL;DR

This paper introduces TINA, a text-free inversion attack that reveals residual visual knowledge of erased concepts in text-to-image diffusion models, exposing limitations of current unlearning methods.

Contribution

TINA is the first text-free inversion attack that bypasses text-centric defenses, revealing persistent visual knowledge in erased models.

Findings

TINA successfully regenerates erased concepts from unlearned models.

Current unlearning methods only obscure, not erase, concepts.

Visual knowledge persists despite text-based concept erasure.

Abstract

Although text-to-image diffusion models exhibit remarkable generative power, concept erasure techniques are essential for their safe deployment to prevent the creation of harmful content. This has fostered a dynamic interplay between the development of erasure defenses and the adversarial probes designed to bypass them, and this co-evolution has progressively enhanced the efficacy of erasure methods. However, this adversarial co-evolution has converged on a narrow, text-centric paradigm that equates erasure with severing the text-to-image mapping, ignoring that the underlying visual knowledge related to undesired concepts still persist. To substantiate this claim, we investigate from a visual perspective, leveraging DDIM inversion to probe whether a generative pathway for the erased concept can still be found. However, identifying such a visual generative pathway is challenging because standard text-guided DDIM inversion is actively resisted by text-centric defenses within the erased model. To address this, we introduce TINA, a novel Text-free INversion Attack, which enforces this visual-only probe by operating under a null-text condition, thereby avoiding existing text-centric defenses. Moreover, TINA integrates an optimization procedure to overcome the accumulating approximation errors that arise when standard inversion operates without its usual textual guidance. Our experiments demonstrate that TINA regenerates erased concepts from models treated with state-of-the-art unlearning. The success of TINA proves that current methods merely obscure concepts, highlighting an urgent need for paradigms that operate directly on internal visual knowledge.