TINA：面向已遗忘文本到图像扩散模型的无文本反演攻击
TINA: Text-Free Inversion Attack for Unlearned Text-to-Image Diffusion Models
用无文本（null-text）DDIM 反演加优化来绕过以文本为中心的擦除防御，为评估扩散模型概念擦除是否真正移除视觉知识提供了一个可复用的探针手段；做 unlearning/safety 评测时可直接借用该 inversion 流程检验模型内部是否仍保留被擦除概念的生成通路。
原文依据 we introduce TINA, a novel Text-free INversion Attack, which enforces this visual-only probe by operating under a null-text condition
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论尽管文本到图像扩散模型展现出强大的生成能力，但为了安全部署，概念擦除技术对于防止生成有害内容至关重要。这促成了擦除防御与旨在绕过防御的对抗性探测之间的动态博弈，而这种共同演化逐步提升了擦除方法的有效性。然而，这种对抗性共同演化收敛到了一个狭窄的、以文本为中心的范式，即把擦除等同于切断文本到图像的映射，却忽略了与不良概念相关的底层视觉知识依然存在。为证实这一论断，我们从视觉视角展开研究，利用 DDIM 反演来探测是否仍能找到被擦除概念的生成通路。然而，识别这样的视觉生成通路颇具挑战，因为标准的文本引导 DDIM 反演会被被擦除模型中以文本为中心的防御主动抵抗。为此，我们提出了 TINA，一种新颖的无文本反演攻击，它通过在空文本条件下运行来强制执行这种纯视觉探测，从而避开现有的以文本为中心的防御。此外，TINA 集成了一个优化过程，以克服标准反演在缺少其惯常文本引导时所产生的累积近似误差。我们的实验表明，TINA 能够从经最优遗忘方法处理的模型中成功重新生成被擦除的概念。TINA 的成功证明当前方法仅仅是在遮蔽概念，凸显出亟需直接在内部视觉知识上运作的新范式。代码将在论文被接收后发布。
英文原文摘要 1718 字符
Although text-to-image diffusion models exhibit remarkable generative power, concept erasure techniques are essential for their safe deployment to prevent the creation of harmful content.This has fostered a dynamic interplay between the development of erasure defenses and the adversarial probes designed to bypass them, and this co-evolution has progressively enhanced the efficacy of erasure methods.However, this adversarial co-evolution has converged on a narrow, text-centric paradigm that equates erasure with severing the text-to-image mapping, ignoring that the underlying visual knowledge related to undesired concepts still persist.To substantiate this claim, we investigate from a visual perspective, leveraging DDIM inversion to probe whether a generative pathway for the erased concept can still be found.However, identifying such a visual generative pathway is challenging because standard text-guided DDIM inversion is actively resisted by text-centric defenses within the erased model.To address this, we introduce TINA, a novel Text-free INversion Attack, which enforces this visual-only probe by operating under a null-text condition, thereby avoiding existing text-centric defenses.Moreover, TINA integrates an optimization procedure to overcome the accumulating approximation errors that arise when standard inversion operates without its usual textual guidance.Our experiments demonstrate that TINA successfully regenerates erased concepts from models treated with state-of-the-art unlearning.The success of TINA proves that current methods merely obscure concepts, highlighting an urgent need for paradigms that operate directly on internal visual knowledge.Code will be released upon acceptance.