Revoking Amnesia: RL-based Trajectory Optimization to Resurrect Erased Concepts in Diffusion Models

TL;DR

This paper reveals that concept erasure in modern diffusion models, including Flux architectures, acts as reversible trajectory steering rather than true forgetting by altering the denoising velocity field. It introduces RevAm, an RL-based framework that recovers erased concepts by dynamically steering sampling trajectories at inference without modifying model weights, using a velocity-control policy trained with Group Relative Policy Optimization (GRPO). RevAm formulates concept recovery as a sequential decision problem on the velocity field, employing a 2D semantic subspace for directional steering and leveraging diverse reward models to guide learning. Across NSFW, artistic styles, and abstract categories, RevAm achieves superior recovery fidelity and speeds, reducing computation by about 10x compared with baselines, and exposing notable vulnerabilities in current erasure methods. The work underscores the need for robust, true-erase techniques beyond trajectory manipulation and motivates further theoretical and defensive advances in concept erasure research.

Abstract

Concept erasure techniques have been widely deployed in T2I diffusion models to prevent inappropriate content generation for safety and copyright considerations. However, as models evolve to next-generation architectures like Flux, established erasure methods (\textit{e.g.}, ESD, UCE, AC) exhibit degraded effectiveness, raising questions about their true mechanisms. Through systematic analysis, we reveal that concept erasure creates only an illusion of ``amnesia": rather than genuine forgetting, these methods bias sampling trajectories away from target concepts, making the erasure fundamentally reversible. This insight motivates the need to distinguish superficial safety from genuine concept removal. In this work, we propose \textbf{RevAm} (\underline{Rev}oking \underline{Am}nesia), an RL-based trajectory optimization framework that resurrects erased concepts by dynamically steering the denoising process without modifying model weights. By adapting Group Relative Policy Optimization (GRPO) to diffusion models, RevAm explores diverse recovery trajectories through trajectory-level rewards, overcoming local optima that limit existing methods. Extensive experiments demonstrate that RevAm achieves superior concept resurrection fidelity while reducing computational time by 10$\times$, exposing critical vulnerabilities in current safety mechanisms and underscoring the need for more robust erasure techniques beyond trajectory manipulation.

Figures (10)

• Figure 1: Concept erasure and recovery in T2I diffusion.(a) Weight edits bias the predicted velocity field, diverting denoising trajectories away from the target concept manifold. (b) RevAm, a simple score-and-steer controller that rates the current preview and selects the next steering direction, manipulating the velocity field at sampling time to re-enter the concept region. RevAm surpasses UnlearnDiffAtk, Ring-A-Bell, and Reason2Attack; reward values are illustrative. Trajectories and densities are visualized schematically for clarity.
• Figure 2: ASR and TTR across all experimental settings. The vertical axis reports TTR normalized for comparability, while the horizontal axis reflects ASR in percentage. Our method achieves the highest attack success rate while simultaneously requiring the least recovery time.
• Figure 3: Qualitative comparison of attack strategies against "nudity" against various erasure methods.Yellow framed images are the original generations from Flux.1 [dev]. Blue bars are manually added for publication purposes.
• Figure 4: Visual comparison between SOTA erasure methods (top row) and our attack (bottom row). Yellow framed images are the original generations from Flux.1 [dev]. Our attack demonstrates strong generality effectiveness across a broad spectrum of concept categories.
• Figure 5: Ablation study on attacking celebrities. The highest classification score (%) obtained within 10 attack iterations and the average number of iterations required to first exceed the 90% threshold. The full method achieves the best performance, yielding the highest CLIP score and the fewest average iterations.