💻 computer science

Erased, But Not Forgotten: Erased Rectified Flow Transformers Still Remain Unsafe Under Concept Attack

This paper introduces ReFlux, a novel concept attack method that exploits attention localization in rectified flow transformers like Flux to demonstrate that current concept erasure techniques remain ineffective and unsafe against targeted reactivation.

Original authors: Nanxiang Jiang, Zhaoxin Fan, Enhan Kang, Daiheng Gao, Yun Zhou, Yanxia Chang, Zheng Zhu, Yeying Jin, Wenjun Wu

Published 2026-04-09

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Nanxiang Jiang, Zhaoxin Fan, Enhan Kang, Daiheng Gao, Yun Zhou, Yanxia Chang, Zheng Zhu, Yeying Jin, Wenjun Wu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: The "Magic Eraser" That Wasn't Magic Enough

Imagine you have a super-smart artist (an AI) who can draw anything you describe. But this artist has learned some bad habits from the internet—they can draw inappropriate or harmful things if you ask for them.

To fix this, developers tried to use a "Magic Eraser" (Concept Erasure). They told the artist, "Forget how to draw nudity, violence, or specific celebrities." They thought they had wiped the artist's memory clean.

The Problem: This paper reveals that the "Magic Eraser" didn't actually wipe the memory. It just put a heavy blanket over the bad thoughts. The artist still remembers how to draw them; they just need someone to pull the blanket off.

The authors created a new tool called ReFlux (the "Blanket Puller") to prove that even after these safety measures, the AI is still unsafe.

The Characters in Our Story

The Artist (Flux): This is the new, super-powerful AI model. Unlike older artists who drew one brushstroke at a time (like Stable Diffusion), Flux is like a symphony conductor. It looks at the whole picture and the words together, flowing smoothly from a blank canvas to a finished masterpiece.
The Safety Team (The Erasers): These are the people who tried to "unlearn" bad concepts. They tried to surgically remove the specific "notes" in the AI's song that correspond to bad ideas.
The Hackers (ReFlux): The authors of this paper. They aren't trying to make bad art; they are trying to test the safety. They want to see if the "unlearning" actually worked.

The Core Discovery: Why Old Tricks Failed

The researchers tried using old tricks (attacks designed for the older artists) to wake up the new artist (Flux), but they failed. Why?

Old Artist (Stable Diffusion): If you want to make the artist draw a "cat," you just whisper the word "cat" louder. The artist listens to individual words.
New Artist (Flux): This artist listens to the whole sentence and the flow of the music. It doesn't care about individual words as much; it cares about how the words connect to the image.

The researchers realized that the Safety Team's "Magic Eraser" worked by hiding the spotlight.

Imagine the AI has a spotlight that shines on the word "cat" in the prompt.
The Safety Team dimmed that spotlight so the artist couldn't see the word "cat."
The Flaw: The artist still knows where the word "cat" is; the spotlight is just turned down low.

The Solution: ReFlux (The Spotlight Booster)

The authors built ReFlux, a clever tool that doesn't just shout the word louder. Instead, it does three smart things:

The Spotlight Booster (Attention Reactivation): It gently turns the dimmed spotlight back up, but carefully so it doesn't blind the artist or ruin the rest of the painting.
The Flow Guide (Velocity Guidance): Since Flux is a "flow" artist, ReFlux nudges the artist's brushstrokes in the right direction, guiding the paint to form the erased concept without messing up the rest of the picture.
The Memory Keeper (Consistency): It makes sure that while the "cat" reappears, the "dog" and the "background" stay exactly the same. It doesn't want to break the whole painting to fix one part.

The Result: With only a tiny amount of extra memory (like a small USB drive), ReFlux successfully made the "erased" concepts appear again, proving the Safety Team's work was incomplete.

The Analogy: The "Whispering Library"

Imagine the AI is a library with millions of books.

The Safety Team took all the books about "Dangerous Ideas" and locked them in a dark basement. They thought no one could find them.
Old Attackers tried to shout "DANGER!" at the library entrance, but the new library (Flux) has soundproof walls, so the shouting didn't work.
ReFlux realized the books weren't gone; they were just in the dark. ReFlux didn't shout; it simply turned on a flashlight in the basement and walked right up to the books.

The authors found that even though the books were locked away, the library staff (the AI) still knew exactly where they were and could pull them out if you showed them the flashlight.

Why Does This Matter?

You might ask, "Why are you trying to break the safety?"

The authors argue that you can't fix what you can't measure.

If we think the "Magic Eraser" works, we might let these AIs loose on the internet, thinking they are safe.
But if they are actually just "hiding" the bad ideas, they can be tricked into showing them again.
ReFlux is like a stress test for a bridge. By trying to break the bridge, they prove it's weak so engineers can build a stronger one.

The Takeaway

The paper concludes that current safety methods for these new, powerful AI models are not strong enough. They are like a "Do Not Disturb" sign on a door; the bad ideas are still behind the door, just waiting for someone to knock hard enough (or use the right key, like ReFlux) to get in.

The authors are calling for better safety tools that don't just hide the bad ideas, but truly remove them, ensuring that next-generation AI is actually safe for everyone.

1. Problem Statement

Recent Text-to-Image (T2I) models, particularly the next-generation Rectified Flow Transformers (e.g., the Flux family), have demonstrated superior generation quality and prompt adherence compared to previous Stable Diffusion (SD) models. However, this progress introduces significant safety risks, necessitating concept erasure techniques to suppress harmful concepts (e.g., nudity, violence, specific artistic styles, or celebrities).

While concept erasure has been extensively studied on SD (based on U-Net and DDPM/DDIM), existing erasure methods and their corresponding attack evaluations fail when applied to Flux.

The Gap: Current attack methods (designed for SD) perform poorly on Flux, failing to reactivate erased concepts.
The Core Issue: There is no systematic benchmark to evaluate the robustness of concept erasure in rectified flow transformers. It remains unclear whether erased concepts in Flux are truly removed or merely suppressed, potentially leaving "concept residues" that can be reactivated.

2. Methodology: ReFlux

The authors propose ReFlux, the first concept attack method specifically designed for rectified flow transformers. The method is built on the insight that Flux erasure relies heavily on attention localization (suppressing specific token indices in attention maps), but existing attacks fail to reverse this due to architectural differences.

Key Technical Components:

Architectural Insight:
- Unlike SD, Flux uses a dual-stream transformer backbone without explicit cross-attention layers. Instead, it concatenates text and pixel embeddings before computing attention.
- Erasure methods in Flux work by suppressing attention weights at specific target token indices.
- Standard adversarial prompt attacks (like Ring-A-Bell) fail because Flux uses T5 encoders (sentence-level semantics) rather than CLIP (word-level semantics), making word-sensitive direction injection ineffective.
ReFlux Framework (Lightweight LoRA Fine-tuning):
ReFlux fine-tunes only 3.57 MB of text-related parameters (specifically add_q_proj and add_k_proj in dual-stream blocks) to reactivate suppressed concepts. It employs a unified loss function composed of three parts:
- Attention Reactivation Loss ( $L_{attn}$ ):
  - Goal: Selectively boost the attention weights of erased tokens.
  - Stabilization: To prevent the "attention divergence" (where naive amplification causes image collapse), the authors use a proximal optimization approach. This includes an L2 regularization term to limit update magnitude and an Entropy term to smooth the attention distribution, ensuring the model stays close to the pretrained distribution while reactivating the target.
- Attack-Guided Velocity Loss ( $L_{attack}$ ):
  - Goal: Steer the flow matching trajectory toward the target concept.
  - Mechanism: Based on the conditional likelihood of generating an image given the target concept. It adjusts the velocity field $v_\theta$ to pull the generative path away from the suppression state and toward the erased concept, effectively "un-learning" the erasure.
- LoRA Consistency Loss ( $L_{lora}$ ):
  - Goal: Preserve global layout and unrelated content.
  - Mechanism: Ensures that the fine-tuned model's velocity field remains consistent with the original model for non-target concepts (e.g., background, pose, style). This prevents the attack from distorting the entire image or altering unrelated attributes.

3. Key Contributions

First Systematic Study on Flux: The paper presents the first comprehensive analysis of concept attacks on rectified flow transformers, revealing that existing erasure methods are fragile in this new architecture.
Identification of Mechanism: The authors demonstrate that Flux erasure relies on attention localization. They prove that while surface-level signals are suppressed, deep semantic traces remain, making the model vulnerable to reactivation.
ReFlux Attack Method: A parameter-efficient (3.57 MB), plug-and-play attack that achieves high precision in restoring erased concepts without degrading image quality or layout.
New Benchmark: Establishes a robust benchmark for evaluating concept erasure robustness across diverse categories (NSFW, artistic styles, entities, abstractions, relationships, and celebrities).

4. Experimental Results

The authors evaluated ReFlux against state-of-the-art erasure methods (ESD, AC, EA, CP, MACE) and existing attack baselines (Ring-A-Bell, UnlearnDiffAtk, P4D) on the Flux.1 [dev] model.

Performance on NSFW Concepts:
- ReFlux achieved the highest Attack Success Rate (ASR) across all erasure methods.
- For Nudity, ReFlux achieved 100% ASR on the original model and 87.16% on the strongest erasure method (CP), significantly outperforming baselines like Ring-A-Bell (which failed completely) and UnlearnDiffAtk.
- For Violence, ReFlux achieved 91.06% ASR, compared to ~72% for the next best method.
Performance on Artistic Styles & Entities:
- ReFlux outperformed baselines in 8 out of 12 evaluation settings for artistic styles (Van Gogh, Picasso).
- It showed superior performance on abstract concepts (e.g., "green," "two") and relationships (e.g., "hug," "kiss"), where other methods often produced distorted or collapsed images.
Efficiency:
- Unlike PGD-based attacks that require 20+ minutes per prompt, ReFlux fine-tunes once per concept and then generates images in standard time (~0.5 minutes), making it highly scalable.
Quality & Consistency:
- LPIPS and CLIP Similarity: ReFlux maintained high visual coherence and layout consistency (low LPIPS, high CLIP scores) compared to other attacks that often resulted in structural collapse or severe artifacts.
- User Study: Human evaluators and VLMs (GPT-5) rated ReFlux highest in concept reactivation, prompt alignment, irrelevant preservation, and image quality.

5. Significance and Implications

Safety Vulnerability: The paper reveals that current concept erasure methods for next-generation T2I models are not robust. They suppress attention signals superficially but fail to remove the underlying semantic representation, leaving models "unsafe" under targeted attacks.
Diagnostic Tool: ReFlux serves as a critical diagnostic tool for the AI safety community, providing a reliable benchmark to test the efficacy of future erasure techniques.
Future Directions: The findings suggest that future erasure strategies must move beyond token-level attention suppression to address deeper, multi-layered semantic representations to achieve true safety. The authors argue that "erased, but not forgotten" is the current state of the art, necessitating more robust defense mechanisms.

In conclusion, ReFlux demonstrates that the safety guarantees of rectified flow transformers are currently illusory, offering a powerful, efficient, and precise method to expose and evaluate the weaknesses of existing concept erasure defenses.