The Illusion of Forgetting: Attack Unlearned Diffusion via Initial Latent Variable Optimization

TL;DR

The Illusion of Forgetting shows that diffusion-model unlearning rarely erases NSFW concepts, which persist as dormant memories and whose residual mappings correlate with a distributional gap in denoising trajectories. The authors introduce IVO, a three-stage latent-space attack that starts from DDIM-inverted NSFW images, then optimizes initial latent variables via a dual-loss objective to realign the noise distributions of unlearned and standard DMs, and finally reuses successful latents from a latent pool to accelerate attacks. Across eight unlearning methods and multiple datasets, IVO achieves high attack success rates and maintains semantic fidelity, outperforming prompt-based and other latent-space attacks and revealing fundamental weaknesses in current defenses. The work highlights the need for stronger, weight-level or verifiable unsafe-content elimination and provides a practical red-teaming framework that can extend to broader attack scenarios and defenses in diffusion models.

Abstract

Although unlearning-based defenses claim to purge Not-Safe-For-Work (NSFW) concepts from diffusion models (DMs), we reveals that this "forgetting" is largely an illusion. Unlearning partially disrupts the mapping between linguistic symbols and the underlying knowledge, which remains intact as dormant memories. We find that the distributional discrepancy in the denoising process serves as a measurable indicator of how much of the mapping is retained, also reflecting the strength of unlearning. Inspired by this, we propose IVO (Initial Latent Variable Optimization), a concise and powerful attack framework that reactivates these dormant memories by reconstructing the broken mappings. Through Image Inversion}, Adversarial Optimization and Reused Attack, IVO optimizes initial latent variables to realign the noise distribution of unlearned models with their original unsafe states. Extensive experiments across 8 widely used unlearning techniques demonstrate that IVO achieves superior attack success rates and strong semantic consistency, exposing fundamental flaws in current defenses. The code is available at anonymous.4open.science/r/IVO/. Warning: This paper has unsafe images that may offend some readers.

Figures (22)

• Figure 1: Our proposed IVO, which optimizes the initial latent variable, exhibits a wide range of application scenarios in white-box setting. (a) shows that it is applicable to text-to-image generation, while (b) and (c) validate its usage in image-to-image generation.
• Figure 2: The non-negligible ASR indicates that unlearned DMs retain part of unsafe concept. The Maximum Mean Discrepancy (MMD) gretton2012kernel is further used as an indicator of the destroyed extent of symbol-to-knowledge mapping. SDv1.4 SDv1.4 is a standard DM used for reference.
• Figure 3: Overview of the attack framework. IVO contains three parsimonious stages: Image Inversion, Adversarial Optimization and Reused Attack. The Reused Attack can exploit previously optimized results without requiring additional training.
• Figure 4: Left (a) illustrates a more efficient reconstruction pathway achieved by setting $\hat{z}_t$ as the start point for search. Right (b) shows that generated images will change and contains NSFW content following the optimization of initial latent variable $\hat{z}_t$.
• Figure 5: Image-to-image attack results are obtained through our IVO-driven automatic pipeline. The left three columns exhibit violent/bloody content, and the right three, nudity content. The first row shows safe input images; the second, their masks.