🤖 AI

Erased but Exploitable: Black-box Embedding-Aware Prompting Against Unlearned Text-to-Image Diffusion Models

This paper introduces BEAP, a black-box, embedding-aware adversarial prompting attack that leverages a large language model to iteratively generate high-quality, undetectable prompts, successfully bypassing machine unlearning defenses in text-to-image diffusion models with significantly higher success rates than prior methods.

Original authors: Arian Komaei Koma, Seyed Amir Kasaei, AmirMahdi Sadeghzadeh, Mohammad Hossein Rohban

Published 2026-05-27

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Arian Komaei Koma, Seyed Amir Kasaei, AmirMahdi Sadeghzadeh, Mohammad Hossein Rohban

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: The "Fake Eraser" Problem

Imagine you have a very talented artist who has seen millions of pictures. You ask this artist to "forget" how to draw something specific, like a naked person. You want them to be safe and never draw that again.

To do this, you use a special "machine unlearning" technique. Think of this like taking a red marker and scribbling over the artist's memory of "naked people." You hope that now, if you ask for a picture of a naked person, the artist will say, "I don't know what that is," or draw something else entirely.

The Problem: The authors of this paper discovered that this "red marker" doesn't actually erase the memory. It just hides it. The artist still remembers how to draw it; they just need the right whisper to unlock that memory again.

The Attack: BEAP (The "Whispering Detective")

The paper introduces a new method called BEAP. Think of BEAP as a clever detective who wants to prove the artist still remembers the forbidden image.

Most previous attempts to trick the artist were like shouting gibberish or using code that made no sense (e.g., "naked person x99#!!"). The artist's safety guards (filters) would immediately spot this nonsense and block it.

BEAP is different. It uses a super-smart AI (a Large Language Model) to act as a diplomatic translator. Instead of shouting, BEAP whispers. It tries to describe the forbidden concept using normal, polite, human language that sounds completely innocent to the safety guards.

How BEAP Works (The Three-Step Dance)

BEAP doesn't just guess; it plays a game of "Hot and Cold" with the artist, refining its approach every time. Here is how it works:

The "Vocabulary Map" (Embedding Awareness):
Imagine the artist's brain is a giant library where words are arranged by how similar they feel. The word "naked" is in a specific corner. BEAP creates a map of words that are neighbors to "naked" (like "bare," "skin," "uncovered") but aren't the forbidden word itself. It tells the AI translator: "Use these neighbor words to describe the scene." This keeps the search focused on the right area of the library.
The "Three-Point Scorecard" (Reward Signals):
BEAP tries a prompt, gets a picture, and then checks three things:
- Did we get the forbidden object? (e.g., Did the picture actually show a naked person?)
- Does the picture match the words? (e.g., If I asked for a "woman in a garden," does the picture show a woman in a garden?)
- Is the picture pretty? (Is it blurry or distorted, or is it high quality?)
If the picture fails any of these, BEAP doesn't give up. It tells the AI translator: "That was close, but the picture was too blurry. Try describing it differently, but keep using those 'neighbor' words."
The Iterative Loop:
This happens over and over. BEAP generates a new, slightly better sentence, tries again, and gets a better score. Eventually, it finds a sentence that sounds perfectly normal and safe to the filters, but tricks the artist into drawing the forbidden image in high quality.

The Results: "Erased" but Not Gone

The paper tested this against several different "eraser" methods (like ESD, MACE, and SPM) that were supposed to have removed the concept of nudity from the artist's brain.

The Old Way (Ring-a-Bell): Previous attacks tried to break the system but ended up creating gibberish prompts. The safety filters caught them, or the resulting images were ugly and broken. They had a 0% success rate in making good images.
The BEAP Way: BEAP succeeded in 95% to 99% of cases. It managed to generate high-quality, beautiful images of the "forgotten" concept using sentences that sounded completely natural.
The "Gibberish" Test: The paper checked if BEAP's prompts looked like nonsense. They didn't. They looked like normal English. The safety filters that usually catch "weird" or "broken" text were completely fooled.

The Conclusion

The paper concludes that current methods for "unlearning" are not actually safe. They are like putting a "Do Not Enter" sign on a door instead of locking the door. If you know the right code (or in this case, the right natural-sounding sentence), you can still walk right through.

The authors warn that even after a model is "unlearned," the knowledge is still there, just waiting for a clever prompt to bring it back to life. They created BEAP not to encourage misuse, but to show developers that their current safety measures are fragile and need to be fixed.

Technical Summary: Erased but Exploitable (BEAP)

Problem Statement

Machine unlearning aims to selectively remove specific concepts (e.g., NSFW content, copyrighted styles) from pretrained text-to-image (T2I) diffusion models without retraining from scratch. While methods like ESD, SPM, and MACE have been proposed to "forget" these concepts, recent studies suggest they are vulnerable to residual traces. Existing adversarial attacks designed to recover these unlearned concepts suffer from significant limitations in realistic threat models:

White-box dependency: Methods like Generate-or-Not require access to model weights or gradients, which is unrealistic for deployed systems.
Encoder dependency: Attacks like Ring-a-Bell and QF-Attack require access to the target model's specific text encoder to perform embedding-space searches.
Detectability: Current black-box methods often generate semantically meaningless, high-perplexity "gibberish" prompts. These are easily detected and filtered by simple rule-based safeguards or perplexity-based detectors, rendering them ineffective in real-world scenarios.

The core problem addressed is the lack of a fully black-box, human-readable, and undetectable attack that can effectively exploit the residual knowledge in unlearned diffusion models.

Methodology: BEAP

The authors propose BEAP (Black-box Embedding-Aware Prompting), a framework that leverages a Large Language Model (LLM) to iteratively generate effective adversarial prompts in natural language space. BEAP operates without access to model weights, gradients, or the target model's text encoder.

1. LLM-Driven Semantic Search

BEAP treats the LLM as an iterative optimizer. Starting with an initial prompt describing the target concept, the LLM generates a batch of diverse paraphrased prompts. These prompts are queried against the unlearned diffusion model ( $M_u$ ). The resulting images are evaluated, and the feedback is used to refine the next batch of prompts. Unlike previous methods that optimize in embedding space (leading to unnatural text), BEAP searches directly in the natural language manifold, ensuring the generated prompts remain fluent and human-readable.

2. Multi-Signal Reward Guidance

To guide the LLM toward successful attacks, BEAP employs three complementary reward signals for each generated image:

Concept Detection Score: Uses detectors (e.g., NudeNet, DINOv2) to verify the presence of the unlearned concept.
Text-Image Alignment: Uses ImageReward to ensure the generated image semantically matches the prompt.
Image Quality: Uses an Aesthetic Score to ensure the output is visually coherent and high-quality.

A prompt is considered successful only if it satisfies thresholds for all three signals, preventing "reward hacking" where the model optimizes for one metric at the expense of others.

3. Embedding-Aware Similarity Search

To bridge the gap between natural language and the specific "forgotten" concept in the model's latent space, BEAP introduces an adversarial similarity vocabulary:

Vector Construction: The system constructs a concept vector ( $c_{adv}$ ) by averaging the embedding differences between pairs of prompts containing the concept and their neutralized counterparts (e.g., "naked person" vs. "a person").
Vocabulary Selection: This vector is compared against a reference vocabulary (e.g., Oxford 3000) using cosine similarity. The top- $k$ most similar words are selected.
Guidance: These words are provided to the LLM as "clues." This steers the LLM toward phrasing that lies in the conceptual neighborhood of the unlearned target, effectively guiding the search toward regions where unlearning is incomplete without requiring direct access to the target model's encoder.

Key Contributions

First Fully Black-Box LLM Attack: BEAP is the first framework to generate human-readable, adversarial prompts for T2I models using only black-box access, eliminating the need for model weights or encoder access.
Reward-Guided Iterative Strategy: The authors design a multi-signal feedback loop (concept presence, alignment, quality) that refines prompts iteratively, ensuring high success rates without sacrificing image quality.
Embedding-Aware Search: The introduction of an embedding-guided similarity component allows the LLM to focus on semantically relevant vocabulary, significantly improving the efficiency and effectiveness of the text-space exploration.
Demonstration of Fundamental Vulnerability: The work provides empirical evidence that current unlearning methods fail to completely remove knowledge, as they remain susceptible to natural-language adversarial prompting.

Experimental Results

The authors evaluated BEAP on Stable Diffusion v1.4 models unlearned using five different methods (UCE, ESD, MACE, SPM, Receler) against the I2P benchmark (200 high-nudity prompts).

Attack Success Rate (ASR): BEAP significantly outperforms prior methods. While Ring-a-Bell achieved an ASR of 0% under strict criteria (requiring concept presence, alignment, and quality), BEAP achieved ASR scores between 86% and 99% across all unlearning baselines.
Efficiency: BEAP requires an average of only 15 prompts per successful attack, demonstrating high sample efficiency.
Undetectability: Unlike Ring-a-Bell, which produced gibberish with a perplexity of ~4736 and a 100% gibberish detection rate, BEAP generated prompts with perplexity values (569–653) close to natural language (I2P reference: 505) and a low gibberish detection rate (26%).
Image Quality: BEAP successfully recovered the unlearned concepts while maintaining high aesthetic and alignment scores, whereas Ring-a-Bell produced distorted, low-quality images.
Generalizability: The attack was also tested on object-level unlearning ("golf ball"), where it similarly outperformed baselines, confirming the vulnerability extends beyond safety-sensitive concepts.

Significance and Claims

The paper claims that current machine unlearning pipelines are fundamentally insufficient for guaranteeing the removal of concepts from diffusion models. The authors argue that while unlearning methods may suppress explicit visual traces, they do not eliminate the underlying semantic representations, which can be reactivated through carefully crafted, natural-language prompts.

The significance of this work lies in exposing a critical gap between the theoretical guarantees of unlearning and the practical reality of model security. By demonstrating that unlearned models can be "jailbroken" using fluent, undetectable prompts, the authors highlight the urgent need for more robust, verifiable, and reliable approaches to concept removal in generative AI. The work serves as a warning to model developers that post-hoc filtering and current unlearning techniques are not sufficient defenses against determined adversaries.