Paper deep dive
Your Unlearning Gives You Away: Identifying Erased Concepts in Diffusion Models
Kaiyuan Deng, Yuchen Li, Yang Xiao, Bo Hui, Geng Yuan, Xiaolong Ma
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Existing attacks on unlearned diffusion models assume that the erased concepts are known in advance and focus on recovering them. In practice, however, model providers may not disclose which concepts have been removed, and even with access to the original base model, an adversary may still lack a clear target to attack. In this paper, we aim to answer the following critical but overlooked questions: which concepts have been erased from the model, and how many have been erased in total? To this end, we present Tracer, a framework that rapidly and accurately identifies erased concepts and estimates their number. Tracer efficiently identifies erased concepts without generating and classifying images. By combining lightweight spectral analysis of weight footprints, it enables efficient search over large candidate vocabularies. To distinguish multiple erased concepts, we introduce a footprint coverage objective that guides sequential discovery. Tracer estimates the number of erased concepts by detecting a sharp decline in candidate confidence as the selected concepts account for the erasure footprint, without requiring labeled examples for calibration. The framework requires only lightweight linear algebra and limited forward probes, with no prior knowledge of the unlearning algorithm. Experiments across text-to-image and text-to-video backbones and diverse unlearning methods demonstrate that Tracer identifies erased concepts and estimates their number in seconds, achieving 150 to 137,000 times and 133 to 20,000 times speedups over MIA and brute-force search on image and video models, respectively, with substantially higher identification accuracy.
Tags
Links
- Source: https://arxiv.org/abs/2610.05601v1
- Canonical: https://arxiv.org/abs/2610.05601v1
Trouble viewing inline? Open PDF directly →
Full Text
76,870 characters extracted from source content.
Expand or collapse full text
Your Unlearning Gives You Away: Identifying Erased Concepts in Diffusion Models Kaiyuan Deng Yuchen Li Yang Xiao Bo Hui Geng Yuan Xiaolong Ma The University of Arizona Peking University The University of Tulsa University of Georgia kaiyuan0415@arizona.edu Abstract Existing attacks on unlearned diffusion models assume that the erased concepts are known in advance and focus on recovering them. In practice, however, model providers may not disclose which concepts have been removed, and even with access to the original base model, an adversary may still lack a clear target to attack. In this paper, we aim to answer the following critical but overlooked questions: which concepts have been erased from the model, and how many have been erased in total? To this end, we present Tracer, a framework that rapidly and accurately identifies erased concepts and estimates their number. Tracer efficiently identifies erased concepts without generating and classifying images. By combining lightweight spectral analysis of weight footprints, it enables efficient search over large candidate vocabularies. To distinguish multiple erased concepts, we introduce a footprint coverage objective that guides sequential discovery. Tracer estimates the number of erased concepts by detecting a sharp decline in candidate confidence as the selected concepts account for the erasure footprint, without requiring labeled examples for calibration. The framework requires only lightweight linear algebra and limited forward probes, with no prior knowledge of the unlearning algorithm. Experiments across text-to-image and text-to-video backbones and diverse unlearning methods demonstrate that Tracer identifies erased concepts and estimates their number in seconds, achieving 150–137,000× 137,000× and 133–20,000× 20,000× speedups over MIA and brute-force search on image and video models, respectively, with substantially higher identification accuracy. 1 Introduction Diffusion models (Rombach et al., 2022; Podell et al., 2023; Ding et al., 2022) exhibit powerful generative capabilities. Despite these advances, their large-scale deployment has raised concerns about copyright infringement and harmful or biased content generation. Concept unlearning (Bourtoule et al., 2021; Xu et al., 2024) aims to suppress designated concepts while preserving other generative capabilities. Most existing methods achieve this by modifying pretrained model weights, demonstrating promising results in unlearning individual concepts or sets of concepts. Existing attacks exploit vulnerabilities in unlearned models to regenerate erased content, but they typically assume prior knowledge of the specific concepts to recover (Lu et al., 2026; Pham et al., 2023; Rusanovsky et al., 2025; Zhang et al., 2024c; Chin et al., 2023; Tsai et al., 2024; Yang et al., 2024; Petsiuk and Saenko, 2024; Liu et al., 2026; Xiang et al., 2026; Horwitz et al., 2024). In practice, model providers may not disclose what they have removed. Even access to the original base model does not directly reveal which of its many concepts the provider chose to erase. For example, a provider may erase a small set of individuals’ identities for privacy reasons. Although the base model may still generate depictions of these individuals, access to this capability alone does not tell an adversary who was selected for protection. Identifying the erased concepts therefore provides information beyond access to the original model: it reveals the provider’s undisclosed targets and allows an adversary to focus subsequent attacks on the content the provider sought to suppress. This raises two critical but overlooked questions: without any prior knowledge of the erasure targets, can an adversary know which concepts have been erased from the model, and how many have been erased in total? To the best of our knowledge, no existing method systematically addresses this identification problem in unlearned diffusion models. Figure 1: (a) Motivation: existing unlearning attacks assume known unlearning targets, leaving the identification of targets unexplored. (b) Current problem: adapted MIA and brute-force method incur high computational costs and struggle to determine target counts and distinguish targets from affected non-targets. (c) Tracer: identifies erased concepts and estimates their number in seconds without prior target knowledge, knowledge of the unlearning algorithm, or image generation. Potential approaches include adapting traditional membership inference attacks (MIAs) (Fu et al., 2023; Kong et al., 2024; Duan et al., 2023; Wu et al., 2022; Matsumoto et al., 2023) or comparing images generated by the original and unlearned models for each candidate. However, extending these approaches to reliable and efficient identification of unknown erasure targets presents challenges. First, unlearning can affect both target and non-target concepts. Changes in membership scores or generated content therefore cannot reliably distinguish directly targeted concepts from indirectly affected ones. Second, the number of erased concepts is unknown. Identifying the target set requires determining which candidates to select and when to stop, without target labels for calibration. Third, both approaches incur substantial computational costs even with a predefined candidate set. Without a narrowly specified set, the search may span a vocabulary containing tens of thousands of words, making repeated generation or MIA-based probing prohibitively expensive. In this paper, we introduce a novel method, Tracing Concepts Erased by Unlearning (Tracer), for rapidly and accurately identifying erased concepts and estimates their number without any prior knowledge of the erasure targets. An intuitive but inconclusive approach is to compare the unlearned model weights with its original base model. However, these weight differences span distinct representation spaces, making it difficult to map them directly to erased concepts. To turn these differences into usable evidence, Tracer constructs Gram matrices from weight differences and uses a small set of probe words to identify compatible representation groups, then applies spectral reweighting to balance signals before aggregation, producing an erasure footprint for each group. These footprints provide the basis for identifying candidate concepts whose representations collectively explain the observed changes. To identify multiple erased concepts, we formulate identification as a subspace coverage problem, which measures how much of the erasure footprint a set of candidate concepts can collectively explain. Specifically, starting from an empty set, Tracer iteratively adds the candidate that best explains the remaining footprint energy, reducing redundant selections and directing the search toward other erased concepts. To estimate the number of erased concepts, we track candidate confidence throughout this coverage-based selection process. As the selected concepts account for the dominant footprint energy, a sharp decline in confidence indicates a cutoff in the selected sequence, allowing us to estimate the erased-set size without labeled calibration data. We summarize our contributions as follows: • To the best of our knowledge, we are the first to systematically study erasure-target identification in unlearned diffusion models, exposing an overlooked vulnerability in diffusion unlearning. • We propose Tracer, an efficient framework that accurately identifies multiple erased concepts from large candidate vocabularies without generating or classifying images, making broad searches for undisclosed erasure targets practical. • Tracer automatically estimates how many concepts were erased, without labeled calibration examples, knowledge of the unlearning algorithm, or information about which weights were modified. • Experiments across text-to-image and text-to-video backbones and diverse unlearning methods show that Tracer accurately identifies erased concepts and estimates their number from large candidate vocabularies in seconds, achieving 150–137,000× 137,000× and 133–20,000× 20,000× speedups over MIA and brute-force search on image and video models, respectively. 2 Related Work 2.1 Concept unlearning in diffusion models. Fine-tuning methods steer target-concept noise toward anchor distributions (Gandikota et al., 2023; Kumari et al., 2023; Zhang et al., 2024a; Heng and Soh, 2023; Fan et al., 2023; Lyu et al., 2024; Lu et al., 2024; Zhao et al., 2024; Huang et al., 2024; Bui et al., 2025; Thakral et al., 2025; Li et al., 2025a; Wu et al., 2025). Closed-form methods edit attention projections without retraining (Gandikota et al., 2024; Orgad et al., 2023; Basu et al., 2024; Chavhan et al., 2024; Li et al., 2025c; Wang et al., 2025; Deng et al., 2026b; Deng et al., 2026a; Yao et al., ; Biswas et al., 2026; Lee et al., 2025). Inference-time methods suppress undesirable concepts via guidance or activation intervention (Schramowski et al., 2023; Chen et al., 2025; Deja and others, 2025; Zhang et al., 2025). Recent work extends erasure to flow-matching transformers, including SD3 and FLUX (Gao et al., 2025a; Ranjan et al., 2026; Jiang et al., 2026; Lee et al., 2026). Parallel work targets text-to-video models through editing, low-rank refusal vectors, and training-free safeguards (Liu and Tan, 2024; Yoon et al., 2025; Ye et al., 2025; Xu et al., 2025; Facchiano et al., 2026). Robust methods resist adversarial prompts and subsequent fine-tuning (Zhang et al., 2024b; Kim et al., 2024; Gong et al., 2024; Srivatsan et al., 2025; Bui et al., 2024; Li et al., 2026b; Gao et al., 2025b; Li et al., 2026a). 2.2 Adversarial vulnerabilities of unlearned models. Recent analyses show erased concepts are often suppressed, not removed, resurfacing under subsequent benign fine-tuning or alternative sampling strategies (Rusanovsky et al., 2025; Suriyakumar et al., 2024; Lu et al., 2026; Yuan et al., 2025). Adversarial attacks recover erased concepts. White-box attacks exploit model gradients or internal signals (Yang et al., 2024; Chin et al., 2023; Zhang et al., 2024c; Pham et al., 2023), whereas black-box attacks search adversarial prompts with query-only model access (Tsai et al., 2024; Lyu et al., 2025; Yook et al., 2025). Non-prompt inference-time attacks recover concepts via concept arithmetic, image-guided inversion, or text-free inversion (Petsiuk and Saenko, 2024; Liu et al., 2026; Xiang et al., 2026), while weight-space attacks use fine-tuning or pre-erasure weights (George et al., 2025; Horwitz et al., 2024). Beyond unlearning attacks, diffusion models themselves also face classical privacy attacks on their original training data. Membership inference attacks determine whether a given sample actually belongs to the training set (Matsumoto et al., 2023; Duan et al., 2023; Kong et al., 2024; Fu et al., 2023; Wu et al., 2022). Data extraction and memorization attacks reconstruct or replicate individual training images from the model (Carlini et al., 2023; Somepalli et al., 2023a; Somepalli et al., 2023b). 2.3 Positioning of our study. Our study aims to identify the concepts targeted for erasure in an unlearned model. Existing attacks (Sec 2.2) primarily recover content associated with known erased concepts. Tracer identifies unknown erasure targets and estimates their number without image generation, fine-tuning, or knowledge of the erasure algorithm. This setting shifts the focus from attacking a model to regenerate known erased concepts to identifying which concepts were erased. 3 Method 3.1 Unlearn Threat Model What the adversary holds. A publisher starts from public base weights W, applies a published concept-unlearning method (Section 2.1) to erase an unknown set S⋆S of concepts, and releases the resulting edited weights W′W . The adversary has access only to W, W′W , and a vocabulary C of ordinary words assumed to contain S⋆S . In particular, the adversary knows neither |S⋆||S | nor which erasure algorithm was used, has no labelled examples of erased or non-erased models, and therefore cannot construct shadow models for validation. The adversary may evaluate the full computation graph on text inputs and record the inputs to all changed weight matrices, which are identified directly by comparing W and W′W . Text-encoder matrices are probed from the prompt alone, whereas generative-backbone matrices are probed by pairing the prompt with a single fixed latent at several noise levels. Both probes require only the available model weights and architecture. The sampling loop is never executed, no image is decoded, and no model output is observed. What the attack recovers. The goal of the attack is to recover the identities of the erased concepts: a subset S^⊆ S that should coincide with S⋆S , together with an inferred count n intended to match |S⋆||S |. Because Tracer automatically searches all available aligned model matrices for weight changes and reads the representations they receive, it requires no knowledge of either the erasure algorithm or its edit locations. It therefore applies with minimal assumptions to weight-editing concept-unlearning methods across different model components and architectures. 3.2 Erasure Footprint Assembly Figure 2: Overview of Tracer. (a) Erasure footprint assembly. Erasure imprints are grouped by their probed input representations. Spectrally reshaped and reweighted Gram matrices are fused within compatible groups into footprints GgG_g. (b) Candidate encoding. Candidates are encoded in each group’s input space, whitened to suppress shared structure, and normalized. (c) Unlearned concept disclosure. Tracer iteratively selects concepts explaining the remaining footprint energy. selection combines standardized gains across groups with confidence-based weights. Label-free self-calibration fixes parameters and group weights. Confidence drops determine set size without image generation or algorithm knowledge. Erasure locations depend on the unlearning method and architecture: closed-form editors typically modify cross-attention key and value projections, while fine-tuning may affect other attention and feed-forward layers, including joint or temporal attention in diffusion-transformer and video backbones. Tracer identifies changes from weight differences throughout the computation graph, without knowledge of edit locations. For each matrix ℓ , its imprint is ΔWℓ=Wℓ′−Wℓ W_ =W _ -W_ ; collectively, non-negligible imprints form the erasure footprint. We retain ℓ in ℒL when its relative Frobenius change ‖ΔWℓ‖F/‖Wℓ‖F\| W_ \|_F/\|W_ \|_F exceeds τ=10−8τ=10^-8. This threshold excludes numerical noise. It is four orders of magnitude below the smallest relative imprint observed in our experiments. Combining these imprints introduces two challenges. First, imprints may receive different representations: some act on text encodings; others receive internal activations with different dimensions and semantics. We identify these representations using probe words rather than layer names. An imprint is text-aware if, for every probe, its input has greater cosine similarity to the matching text encoding than to any other probe encoding. This correspondence remains exact for imprints acting on text encodings but can disappear as textual information mixes with image features. Text-aware imprints share one representation group. Each imprint failing the test is text-agnostic and forms a singleton group with location-specific input. Only imprints within the same group are aggregated. Second, imprints within a group may have different output widths despite sharing an input representation, preventing direct summation. The Gram matrix Mℓ=ΔWℓ⊤ΔWℓM_ = W_ W_ removes the output dimension while preserving imprint strength along the shared input space, making these matrices summable. Direct summation may let strongly edited matrices obscure weaker but informative imprints. We therefore reshape each Gram matrix before aggregation. Writing Mℓ=QΛQ⊤M_ =Q Q , the eigenvectors in Q specify its principal directions, and each eigenvalue λ measures the corresponding strength. Reshaping preserves these directions, raises eigenvalues normalized by λmax _ to a power ρ, and discards negligible directions. We additionally weight imprints by their inverse edit magnitude, with strength controlled by β: Gg=∑ℓ∈g∥ΔWℓ∥F−2β[[Mℓ]]ρ,[[Mℓ]]ρ=Qdiag((λ/λmax)ρ[λ/λmax≥ε0])Q⊤.G_g= _ ∈ g\| W_ \|_F^-2β [\! [M_ ]\! ]_ρ, [\! [M_ ]\! ]_ρ=Q\,diag\! ((λ/ _ )^ρ1\! [λ/ _ ≥ _0 ] )Q . (1) Here, [⋅]1[·] denotes the indicator function, and ε0 _0 is the relative spectral cutoff. The self-calibrated exponents ρ and β control the relative strengths of directions within each imprint and contributions across imprints, respectively. This produces one aggregated footprint GgG_g per representation group. 3.3 Geometry-Aware Candidate Encoding Each vocabulary entry in C is a candidate. We encode each candidate in the input space of its group’s footprint. We insert the candidate into a set T of neutral prompt templates, pass the prompts through the network, and average the representations received by group g across templates to obtain xc,gx_c,g. One template turns church into “a photo of a church.” For a text-aware group, we use the text encoding at the token position specified by offset o. For a text-agnostic group, we use the internal activation at that location, averaged over applicable token positions. Groups in the generative backbone additionally average over fixed noise levels. Template averaging reduces sensitivity to phrasing and emphasizes the candidate. Each candidate is represented separately in each group’s input space. Candidate representations are unevenly distributed within each group’s input space: a few directions carry much of the vocabulary energy, giving many candidates large shared components. Candidates aligned with these directions may score highly against different footprints regardless of which concepts were erased. We suppress this shared structure to emphasize candidate-specific information. We construct a regularized second-moment matrix over the full vocabulary and normalize the transformed representations: Σg=c∈[xc,gxc,g⊤]+εwI,x~c,g=Σg−γ/2xc,g∥Σg−γ/2xc,g∥, _g=E_c [x_c,gx_c,g ]+ _wI, x_c,g= _g^-γ/2x_c,g \| _g^-γ/2x_c,g \|, (2) where the expectation is the uncentered second moment and I is the identity. We set εw=10−3c∈‖xc,g‖2/dg _w=10^-3E_c \|x_c,g\|^2/d_g, where dgd_g is the group’s input dimension. Regularization ensures positive definiteness and limits amplification of weak directions. We compute Σg−γ/2 _g^-γ/2 through eigendecomposition. Directions carrying more vocabulary energy are attenuated more strongly. γ controls suppression from no transformation to full whitening. o and γ are selected by self-calibration in Section 3.4 before iterative candidate selection. Unit normalization prevents larger norms from inflating candidate scores in footprint comparisons using x~c,g x_c,g. 3.4 Unlearned Concept Disclosure Subspace Coverage Scoring. The footprint identifies a subspace whose eigenvectors may rotate within eigenspaces with equal or nearly equal eigenvalues. We therefore match candidate spans to the footprint rather than associate individual spectral directions with words. For S⊆S , coverage measures the fraction of footprint energy captured by its candidate span: ϕg(S)=tr(PS,gGgPS,g)tr(Gg), _g(S)= tr (P_S,gG_gP_S,g )tr(G_g), (3) where PS,gP_S,g projects orthogonally onto spanx~c,g:c∈Sspan\ x_c,g:c∈ S\ and tr(⋅)tr(·) denotes the trace. The singleton score sg(c)=ϕg(c)s_g(c)= _g(\c\) defines the group’s initial field. Additional coverage measures contributions beyond S, with zero gain for candidates within the span. To measure field separation, we define confκ(s)=maxcs(c)−med(s)q1−κ(s)−med(s)+εc.conf_κ(s)= _cs(c)-med(s)q_1-κ(s)-med(s)+ _c. (4) Here, s is the field over candidates, med(s)med(s) its median, and q1−κ(s)q_1-κ(s) its (1−κ)(1-κ)-quantile. κ∈(0,1/2)κ∈(0,1/2) specifies the upper-tail comparison range, while εc>0 _c>0 stabilizes the ratio. A constant field has zero confidence. The numerator measures the leader’s separation from the median; the denominator normalizes it by the upper-tail spread. This reduces sensitivity to score scale while retaining dependence on the candidate vocabulary. Groups observe different representations, so we standardize their gains and weight them by the separation of leading candidates in their initial fields: zg(c,S)=ϕg(S∪c)−ϕg(S)−μg(S)σg(S)+εz,wg=maxconfκ(sg),εg∑g′maxconfκ(sg′),εg,z_g(c,S)= _g (S∪\c\ )- _g(S)- _g(S) _g(S)+ _z, w_g= \conf_κ(s_g), _g\ _g \conf_κ(s_g ), _g\, (5) where μg(S) _g(S) and σg(S) _g(S) are the gain mean and standard deviation over C. The constants εz>0 _z>0 and εg>0 _g>0 stabilize standardization and ensure positive group weights, respectively. For any parameter setting, the initial combined field is s(1)(c)=∑gwgzg(c,∅)s^(1)(c)= _gw_gz_g(c, ). Self-Calibration. Candidate fields depend on spectral shaping ρ, whitening γ, imprint-amplitude weighting β, and the token offset o. Without a labelled validation set, the adversary evaluates each setting through its initial combined field, before selecting a candidate. Writing θ=(β,γ,ρ,o)θ=(β,γ,ρ,o), we evaluate a predefined finite set Θ and select θ⋆=argmaxθ∈Θconfκ(sθ(1))θ = *arg\,max_θ∈ conf_κ(s_θ^(1)). sθ(1)s_θ^(1) is constructed with the footprint operators, candidate representations, and group weights induced by θ. This selection requires no knowledge of the erased-set size. The setting and its group weights remain fixed throughout the search. Candidate gains and their standardization are updated as the span expands. Progressive Concept Pursuit. With the calibrated setting, we greedily construct a candidate sequence by maximizing additional coverage across groups. Overlapping vocabulary expressions may remain prominent after a related candidate is selected because their representations need not lie in its span. We suppress these lexical overlaps after each selection. Let ℱ(c)F(c) contain c and all vocabulary entries whose token sets are subsets or supersets of its token set. These entries are excluded from subsequent selection using only the vocabulary, without erased-concept labels or an assumption of semantic equivalence. Starting from S0=D0=∅S_0=D_0= , let SjS_j and DjD_j denote the selected and excluded entries after step j. Each step combines the group gains into the global score s(j)(c)=∑gwgzg(c,Sj−1)s^(j)(c)= _gw_gz_g(c,S_j-1). We select the candidate cjc_j with the highest score among entries not in Dj−1D_j-1. We add cjc_j to the selected set and exclude all entries in ℱ(cj)F(c_j) from subsequent selection. Other suppressed entries are not added to the selected span. The search uses a fixed horizon J without prior knowledge of the erased-set size. We record confidence over eligible candidates initially and after each selection to determine how many selected candidates are retained in the output. Erased-Set Size Detection. We determine the candidate sequence’s cutoff by tracking how clearly the remaining field separates its leader from the background. A pronounced decline suggests exhaustion of the dominant erasure signal. After selecting j candidates, we record aj=confκ(s(j+1))a_j=conf_κ(s^(j+1)) for j=0,…,Jj=0,…,J. Confidence is computed only over candidates that have neither been selected nor excluded by lexical suppression. Thus, a0a_0 measures initial separation, while aJa_J measures separation after the final selection. We measure the confidence decline following the i-th selection as ri=logmaxai−1,εa−logmaxai,εa,i=1,…,J,r_i= \a_i-1, _a\- \a_i, _a\, i=1,…,J, (6) where εa>0 _a>0 keeps logarithms defined. A positive rir_i indicates a decline, with its magnitude measuring the log confidence ratio. The largest decline provides the default size estimate. Some profiles rise as selecting dominant candidates makes remaining targets more distinguishable, then decline in stages because related vocabulary entries remain prominent. The largest decline may therefore occur after the erased set has been selected. For these profiles, we identify the first sufficiently large decline. The initial-rise condition holds when confidence increases in at least B−1B-1 of the first B transitions, where 3≤B≤J3≤ B≤ J is a fixed window length. Let rmaxr_ denote the largest log confidence drop and α∈(0,1)α∈(0,1) a relative threshold. If the initial-rise condition holds and rmax>0r_ >0, we estimate n=mini:ri≥αrmaxn= \i:r_i≥α r_ \ over i=1,…,Ji=1,…,J, selecting the first drop reaching a fraction α of the largest drop. Otherwise, n is the index of the largest drop, with ties resolved by choosing the earliest selection. Both rules use only the confidence sequence. The estimate n determines the set S^=Sn S=S_n, comprising the first n candidates. The horizon J bounds the search without prescribing the output size. Implementation settings are detailed in Appendix A.1 and Appendix A.2. Table 1: Identification accuracy (%) of erased object concepts across three text-to-image backbones on Imagenette-20. Shaded cells report evaluated results. “–” indicates an unevaluated setting. Method Venue Erased-set size K Avg. (↑ ) 1 3 5 10 20 Stable Diffusion v1.5 ESD ICCV 2023 100 100 94 – – 98.0 UCE WACV 2024 100 100 100 100 100 100.0 MACE CVPR 2024 100 100 100 100 – 100.0 FMN CVPR 2024a 100 100 100 – – 100.0 ConceptPrune ICLR 2024 100 100 100 94 – 98.5 Sculpting ICCV 2025b 100 100 100 100 – 100.0 SPEED ICLR 2025c 100 100 – – – 100.0 ScaPre ICLR 2026b 100 100 100 100 100 100.0 FIA ICML 2026a 100 100 100 100 – 100.0 AdvUnlearn NeurIPS 2024b 100 – – – – 100.0 STEREO CVPR 2025 100 100 – – – 100.0 Meta-Unlearning ICCV 2025b 100 – – – – 100.0 Stable Diffusion 3 UCE WACV 2024 100 100 94 – – 98.0 EraseFlow NeurIPS 2026 100 100 100 – – 100.0 FLUX.1 EraseAnything ICML 2025a 100 100 – – – 100.0 ScaPre ICLR 2026b 100 100 100 100 – 100.0 4 Experiment 4.1 Experimental Settings We evaluate Tracer on three text-to-image backbones: Stable Diffusion v1.5 (Rombach et al., 2022), Stable Diffusion 3 (Esser et al., 2024), and FLUX.1 (Labs, 2024). The text-to-video backbones are CogVideoX-5B (Yang et al., 2025) and Wan2.1-T2V-1.3B (Wan et al., 2025). We use official implementations and released checkpoints without modification. Object identification is evaluated on the ten Imagenette classes (Howard and others, 2019). Explicit-content evaluation uses I2P prompts (Schramowski et al., 2023). Artistic-style identification covers the artists evaluated by ESD (Gandikota et al., 2023) and UCE (Gandikota et al., 2024). Generation quality is evaluated on MS COCO (Lin et al., 2014). We construct Imagenette-20 by augmenting Imagenette’s ten classes (Howard and others, 2019) with 10 non-overlapping common object categories from ImageNet-1k (Russakovsky et al., 2015) to evaluate identification across varying erased-set sizes. All experiments run on NVIDIA RTX A6000 GPUs. 4.2 Disclosing Erased Concept in Unlearned Models Reproducing unlearning methods with their official implementations reveals limits on stable erasure capacity. Beyond these limits, models exhibit degraded forgetting or damaged generative capabilities. Shaded cells in Table 1 indicate evaluated settings within these limits; excluded settings are marked “–”. We evaluate varying erased-set sizes, where K denotes the number of concepts jointly erased from each checkpoint. For each size, we sample concept sets from Imagenette-50, shared across methods and backbones. Each set is jointly erased to produce a checkpoint. We define recovery accuracy as the percentage of checkpoints whose recovered set exactly matches the ground-truth erased set. Correct recovery identifies all erased concepts without extras, jointly testing concept identities and inferred set size. Partial recovery counts as failure. The Avg. column averages recovery accuracy over evaluated set sizes within each method’s stable erasure range, excluding “–”. Higher values indicate better performance (↑ ). Table 3 extends the same protocol to text-to-video models. Evaluation is restricted to individual concepts and small groups, where the tested methods maintain stable erasure. Tracer achieves perfect recovery for both methods on CogVideoX-5B and for Refusal on Wan2.1-T2V-1.3B. For VideoEraser on Wan2.1-T2V-1.3B, recovery remains perfect for individual concepts, with a modest decline under joint erasure. These results demonstrate that erasure footprints remain informative across video architectures with different temporal modeling, enabling accurate identification of both individual targets and jointly erased concept sets. To assess size estimation separately from concept identification, Table 4 reports the percentage of checkpoints whose inferred count matches the true erased-set size. Tracer achieves perfect size estimation in most settings across image and video models, with occasional errors for ConceptPrune and SPEED under joint erasure. Figure 4 illustrates the confidence dynamics for UCE and Refusal. Normalized confidence remains high during early selections, then drops sharply once the selected sequence reaches the true erased-set size. This decline reflects reduced separation between the leading remaining candidate and the background, suggesting exhaustion of the dominant erasure signal. The confidence-drop rule uses this transition to estimate the target count without prior size information. Artistic-style identification results are reported in Appendix B. Figure 3: Exact estimation accuracy (%) of the erased-set size K across evaluated image and video unlearning methods. Method Ground-truth size K 1 3 5 10 20 text-to-image (Stable Diffusion v1.5) ESD 100 100 100 – – UCE 100 100 100 100 100 MACE 100 100 100 100 – ConceptPrune 100 100 98 – – SPEED 100 100 92 – – ScaPre 100 100 100 100 100 text-to-image (FLUX.1) EraseAnything 100 100 – – – EraseFlow 100 100 100 – – text-to-video (CogVideoX-5B) Refusal 100 100 100 – – VideoEraser 100 100 – – – Figure 4: Normalized confidence aj/a0a_j/a_0 drops at the true erased-set size K for UCE and Refusal. Table 2: Recall@K (%) with the true K provided, evaluated over 50 checkpoints per setting. Baseline Method Recall@K (↑ ) Recall@10 (↑ ) K=1K=1 K=3K=3 K=5K=5 ESD MIA 42.0 6.7 4.8 27.1 Brute-force 82.0 33.3 16.2 53.3 Tracer 100.0 100.0 100.0 100.0 UCE MIA 60.0 24.0 14.0 39.6 Brute-force 92.0 68.7 36.6 72.2 Tracer 100.0 100.0 100.0 100.0 SPEED MIA 78.0 63.3 42.4 68.9 Brute-force 76.0 60.0 38.8 66.5 Tracer 100.0 100.0 100.0 100.0 ScaPre MIA 80.0 72.0 48.2 74.7 Brute-force 90.0 78.7 52.0 80.4 Tracer 100.0 100.0 100.0 100.0 Table 3: Identification accuracy (%) of erased object concepts across two text-to-video backbones with K∈1,3K∈\1,3\, following the protocol of Table 1. Method Venue Size K Avg. (↑ ) 1 3 CogVideoX-5B VideoEraser EMNLP 2025 100 100 100.0 Refusal ICLR 2026 100 100 100.0 Wan2.1-T2V-1.3B VideoEraser EMNLP 2025 100 90 95.0 Refusal ICLR 2026 100 100 100.0 4.3 Comparison With Traditional Adversarial Methods We compare Tracer with two approaches. Adapted MIA ranks concepts by aggregated changes in sample-level membership scores. Brute-force probing ranks candidates by comparing images generated before and after unlearning. Implementation details are provided in Appendix A.3. We evaluate ESD, UCE, SPEED, and ScaPre on Stable Diffusion v1.5, with 50 checkpoints per erased-set size K∈1,3,5K∈\1,3,5\. All approaches share checkpoints and 1,000-name vocabulary. To accommodate conventional methods, all receive the true K; Tracer uses its iterative selection order without size estimation. Unlike exact-set accuracy, this comparison credits partial recovery. Let Tm(L)T_m^(L) contain the first L candidates for checkpoint m. We compute Recall@L=10050∑m=150|Tm(L)∩Sm⋆|/KRecall@L= 10050 _m=1^50|T_m^(L)∩ S_m |/K, where Sm⋆S_m is the erased set. Table 3 reports Recall@K for each K; recovering three of five targets scores 60%. Recall@10 uses L=10L=10 with denominator K. Its reported value equally averages the three K settings. Tracer maintains high recall across methods and set sizes, while baseline recall generally declines as K grows. Allowing ten candidates improves baseline coverage but leaves targets unidentified, supporting the effectiveness of weight footprints beyond behavioral changes alone. Figure 5 compares runtime across candidate vocabulary sizes on (a) Stable Diffusion v1.5, (b) FLUX.1, and (c) CogVideoX-5B. Tracer exhibits modest runtime growth as the vocabulary expands across all backbones. Across the evaluated vocabulary sizes, Tracer achieves 150150–137,000×137,000× and 133133–20,000×20,000× speedups over MIA and brute-force probing on image and video models, respectively. Weight analysis with limited forward probes avoids repeated image or video generation and sample-level membership evaluation, enabling efficient concept identification over large candidate vocabularies. Figure 5: Runtime across three methods, showing the scalability of Tracer to large candidate sets. 4.4 Ablation Studies We evaluate components on 50 checkpoints per unlearning method at K=5K=5. Table 5 provides K to isolate concept identification from size estimation. The single imprint variant retains the imprint with the highest initial confidence in each group. Removing background suppression sets γ=0γ=0 while preserving unit normalization. Removing progressive selection uses the initial ranking without updating coverage gains, retaining lexical suppression. Tracer achieves 100% Recall@5 across four methods. Using a single imprint reduces recall by 5.2 to 16.0 percentage points, supporting evidence integration across weight changes. Removing background suppression causes declines of 7.6 to 23.2 points. Replacing progressive selection with static ranking produces the largest reduction across methods, reaching 43.6 points on ESD. These results support updating candidate scores to capture information beyond the selected span. Table 5 evaluates exact recovery of the erased set without providing K. Replacing self-calibration with fixed parameters reduces accuracy to between 78% and 92%. Always selecting the largest confidence drop, without accounting for an initial rise, yields accuracy between 64% and 80%. The full method achieves 100% across four methods, supporting both calibration for each checkpoint and size estimation adapted to the confidence profile. Table 4: Component ablations in Recall@5 (%) with the true number of erasure targets K=5K=5 provided. Variant ESD UCE SPEED ScaPre Full Tracer 100.0 100.0 100.0 100.0 Single imprint per group 84.0 94.8 88.4 91.6 w/o background suppression 76.8 92.4 90.8 88.0 w/o progressive selection 56.4 78.4 82.8 81.2 Table 5: Calibration and size-detection ablations in exact-set recovery accuracy (%). Variant ESD UCE SPEED ScaPre Full Tracer 100.0 100.0 100.0 100.0 w/o self-calibration 78 84 92 86 Largest-drop only 72 64 78 80 5 Conclusion We presented Tracer, which accurately identifies erasure targets and their number from publicly released model weights in seconds without image generation. Experiments demonstrate its effectiveness across image and video backbones and diverse unlearning methods. It enables label-free search over large candidate vocabularies, achieving substantial speedups over membership inference attacks and brute-force generation-based probing methods. Our work establishes erasure-target identification as a distinct task and provides a practical and computationally efficient framework for assessing what model weights reveal about erasure targets despite suppressed generation. AI Use Statement In this work, generative AI tools were used solely to correct grammatical errors and improve the clarity of the English writing, without changing the scientific content. They were not used to generate research ideas, develop the methodology, conduct experiments, write or analyze code, interpret results, formulate claims, or create figures and other research artifacts. All scientific content and contributions were developed independently by the authors. Ethics Statement This work does not involve human subjects, personally identifiable information, private data, or sensitive user information. All models and datasets used in this study are publicly available and are employed solely for academic research. We are not aware of any ethical concerns, conflicts of interest, or issues related to discrimination, privacy, security, or legal compliance arising from this work. The authors follow established responsible research practices. Reproducibility Statement We have made every effort to ensure the reproducibility of this work. The complete methodological pipeline and all components of the proposed approach are described in detail in the main paper, with additional implementation details provided in the appendix. These descriptions are intended to enable independent reproduction of our method and experimental results. Upon acceptance, we will publicly release the complete source code and accompanying configurations. References Basu et al. (2024) S. Basu, N. Zhao, V. Morariu, S. Feizi, and V. Manjunatha Localizing and editing knowledge in text-to-image generative models. In International Conference on Learning Representations, Vol. 2024, p. 17592–17603. Cited by: §2.1. Biswas et al. (2026) S. D. Biswas, A. Roy, and K. Roy Cure: concept unlearning via orthogonal representation editing in diffusion models. Advances in Neural Information Processing Systems 38, p. 82539–82563. Cited by: §2.1. Bourtoule et al. (2021) L. Bourtoule, V. Chandrasekaran, C. A. Choquette-Choo, H. Jia, A. Travers, B. Zhang, D. Lie, and N. Papernot Machine unlearning. In 2021 IEEE symposium on security and privacy (SP), p. 141–159. Cited by: §1. Bui et al. (2025) A. Bui, T. Vu, L. Vuong, T. Le, P. Montague, T. Abraham, J. Kim, and D. Phung Fantastic targets for concept erasure in diffusion models and where to find them. arXiv preprint arXiv:2501.18950. Cited by: §2.1. Bui et al. (2024) A. Bui, L. Vuong, K. Doan, T. Le, P. Montague, T. Abraham, and D. Phung Erasing undesirable concepts in diffusion models with adversarial preservation. arXiv preprint arXiv:2410.15618. Cited by: §2.1. Carlini et al. (2023) N. Carlini, J. Hayes, M. Nasr, M. Jagielski, V. Sehwag, F. Tramer, B. Balle, D. Ippolito, and E. Wallace Extracting training data from diffusion models. In 32nd USENIX security symposium (USENIX Security 23), p. 5253–5270. Cited by: §2.2. Chavhan et al. (2024) R. Chavhan, D. Li, and T. Hospedales ConceptPrune: concept editing in diffusion models via skilled neuron pruning. arXiv preprint arXiv:2405.19237. Cited by: Table 9, §2.1, Table 1. Chen et al. (2025) D. Chen, Z. Li, M. Fan, C. Chen, W. Zhou, Y. Wang, and Y. Li Growth inhibitors for suppressing inappropriate image concepts in diffusion models. In International Conference on Learning Representations, Vol. 2025, p. 79164–79184. Cited by: §2.1. Chin et al. (2023) Z. Chin, C. Jiang, C. Huang, P. Chen, and W. Chiu Prompting4debugging: red-teaming text-to-image diffusion models by finding problematic prompts. arXiv preprint arXiv:2309.06135. Cited by: §1, §2.2. Deja et al. (2025) K. Deja et al. SAeUron: interpretable concept unlearning in diffusion models with sparse autoencoders. arXiv preprint arXiv:2501.18052. Cited by: §2.1. Deng et al. (2026a) K. Deng, B. Hui, G. Li, J. Ji, M. Qin, G. Yuan, and X. Ma Forget-it-all: multi-concept machine unlearning via concept-aware neuron masking. arXiv preprint arXiv:2601.06163. Cited by: Table 9, §2.1, Table 1. Deng et al. (2026b) K. Deng, G. Li, Y. Xiao, B. Hui, and X. Ma Forget many, forget right: scalable and precise concept unlearning in diffusion models. arXiv preprint arXiv:2601.06162. Cited by: Table 9, Table 9, §2.1, Table 1, Table 1. Ding et al. (2022) M. Ding, W. Zheng, W. Hong, and J. Tang Cogview2: faster and better text-to-image generation via hierarchical transformers. Advances in Neural Information Processing Systems 35, p. 16890–16902. Cited by: §1. Duan et al. (2023) J. Duan, F. Kong, S. Wang, X. Shi, and K. Xu Are diffusion models vulnerable to membership inference attacks?. In International Conference on Machine Learning, p. 8717–8730. Cited by: §1, §2.2. Esser et al. (2024) P. Esser, S. Kulal, A. Blattmann, R. Entezari, J. Müller, H. Saini, Y. Levi, D. Lorenz, A. Sauer, F. Boesel, et al. Scaling rectified flow transformers for high-resolution image synthesis. In International Conference on Machine Learning, Cited by: §4.1. Facchiano et al. (2026) S. Facchiano, S. Saravalle, M. Migliarini, E. De Matteis, A. Sampieri, A. Pilzer, E. Rodolà, I. Spinelli, L. Franco, and F. Galasso Video unlearning via low-rank refusal vector. In International Conference on Learning Representations, Vol. 2026, p. 132049–132078. Cited by: §2.1, Table 3, Table 3. Fan et al. (2023) C. Fan, J. Liu, Y. Zhang, E. Wong, D. Wei, and S. Liu Salun: empowering machine unlearning via gradient-based weight saliency in both image classification and generation. arXiv preprint arXiv:2310.12508. Cited by: §2.1. Fu et al. (2023) W. Fu, H. Wang, C. Gao, G. Liu, Y. Li, and T. Jiang A probabilistic fluctuation based membership inference attack for diffusion models. arXiv preprint arXiv:2308.12143. Cited by: §1, §2.2. Gandikota et al. (2023) R. Gandikota, J. Materzynska, J. Fiotto-Kaufman, and D. Bau Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 2426–2436. Cited by: §A.1, Table 9, §2.1, Table 1, §4.1. Gandikota et al. (2024) R. Gandikota, H. Orgad, Y. Belinkov, J. Materzyńska, and D. Bau Unified concept editing in diffusion models. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, p. 5111–5120. Cited by: §A.1, Table 9, Table 9, §2.1, Table 1, Table 1, §4.1. Gao et al. (2025a) D. Gao, S. Lu, W. Zhou, J. Chu, J. Zhang, M. Jia, B. Zhang, Z. Fan, and W. Zhang Eraseanything: enabling concept erasure in rectified flow transformers. In Forty-second International Conference on Machine Learning, Cited by: Table 9, §2.1, Table 1. Gao et al. (2025b) H. Gao, T. Pang, C. Du, T. Hu, Z. Deng, and M. Lin Meta-unlearning on diffusion models: preventing relearning unlearned concepts. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 2131–2141. Cited by: Table 9, §2.1, Table 1. George et al. (2025) N. George, K. N. Dasaraju, R. R. Chittepu, and K. R. Mopuri The illusion of unlearning: the unstable nature of machine unlearning in text-to-image diffusion models. In 2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 13393–13402. Cited by: §2.2. Gong et al. (2024) C. Gong, K. Chen, Z. Wei, J. Chen, and Y. Jiang Reliable and efficient concept erasure of text-to-image diffusion models. In European Conference on Computer Vision, p. 73–88. Cited by: §2.1. Heng and Soh (2023) A. Heng and H. Soh Selective amnesia: a continual learning approach to forgetting in deep generative models. Advances in Neural Information Processing Systems 36, p. 17170–17194. Cited by: §2.1. Horwitz et al. (2024) E. Horwitz, J. Kahana, and Y. Hoshen Recovering the pre-fine-tuning weights of generative models. arXiv preprint arXiv:2402.10208. Cited by: §1, §2.2. Howard et al. (2019) J. Howard et al. Imagenette: a smaller subset of imagenet for quick experiments. Note: https://github.com/fastai/imagenette Cited by: §A.1, §4.1. Huang et al. (2024) C. Huang, K. Chang, C. Tsai, Y. Lai, F. Yang, and Y. F. Wang Receler: reliable concept erasing of text-to-image diffusion models via lightweight erasers. In European Conference on Computer Vision, p. 360–376. Cited by: §2.1. Jiang et al. (2026) N. Jiang, Z. Fan, B. Wang, D. Gao, J. Cheng, J. Guo, Y. Qin, Y. Jin, H. Zheng, F. Wu, et al. Z-erase: enabling concept erasure in single-stream diffusion transformers. arXiv preprint arXiv:2603.25074. Cited by: §2.1. Kim et al. (2024) C. Kim, K. Min, and Y. Yang Race: robust adversarial concept erasure for secure text-to-image diffusion model. In European Conference on Computer Vision, p. 461–478. Cited by: §2.1. Kong et al. (2024) F. Kong, J. Duan, H. T. Shen, X. Shi, X. Zhu, K. Xu, et al. An efficient membership inference attack for the diffusion model by proximal initialization. In International Conference on Learning Representations, Vol. 2024, p. 57876–57896. Cited by: §A.3, §A.3, §1, §2.2. Kumari et al. (2023) N. Kumari, B. Zhang, S. Wang, E. Shechtman, R. Zhang, and J. Zhu Ablating concepts in text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 22691–22702. Cited by: §2.1. Kusumba et al. (2026) N. S. A. Kusumba, M. Patel, K. Min, C. Kim, C. Baral, and Y. Yang Eraseflow: learning concept erasure policies via gflownet-driven alignment. Advances in Neural Information Processing Systems 38, p. 70876–70911. Cited by: Table 9, Table 1. Labs (2024) B. F. Labs Flux: advancing generative models for creative workflows. Note: https://huggingface.co/black-forest-labs/FLUX.1 Cited by: §4.1. Lee et al. (2025) B. H. Lee, S. Lim, and S. Y. Chun Localized concept erasure for text-to-image diffusion models using training-free gated low-rank adaptation. In 2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 18596–18606. Cited by: §2.1. Lee et al. (2026) U. Lee, J. Kim, and S. Hwang Localized concept erasure in text-to-image diffusion models via high-level representation misdirection. In The Fourteenth International Conference on Learning Representations, Cited by: §2.1. Li et al. (2026a) B. Li, R. Gu, J. Wang, L. Qi, Y. Li, R. Wang, Z. Qin, and T. Zhang Towards resilient safety-driven unlearning for diffusion models against downstream fine-tuning. Advances in Neural Information Processing Systems 38, p. 17754–17789. Cited by: §2.1. Li et al. (2025a) F. Li, Q. Xu, S. Bao, Z. Yang, X. Cao, and Q. Huang One image is worth a thousand words: a usability preservable text-image collaborative erasing framework. arXiv preprint arXiv:2505.11131. Cited by: §2.1. Li et al. (2026b) F. Li, K. Li, Q. Wang, B. Han, and J. Zhou AEGIS: adversarial target-guided retention-data-free robust concept erasure from diffusion models. arXiv preprint arXiv:2602.06771. Cited by: §2.1. Li et al. (2025b) G. Li, Y. Xiao, J. Ji, K. Deng, B. Hui, L. Guo, and X. Ma Sculpting memory: multi-concept forgetting in diffusion models via dynamic mask and concept-aware optimization. In 2025 IEEE/CVF International Conference on Computer Vision (ICCV), p. 19659–19668. Cited by: Table 9, Table 1. Li et al. (2025c) O. Li, Y. Wang, X. Hu, H. Jiang, T. Liang, Y. Hao, G. Ma, and F. Feng Speed: scalable, precise, and efficient concept erasure for diffusion models. arXiv preprint arXiv:2503.07392. Cited by: Table 9, §2.1, Table 1. Lin et al. (2014) T. Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Dollár, and C. L. Zitnick Microsoft coco: common objects in context. In Computer vision–ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceedings, part v 13, p. 740–755. Cited by: §4.1. Liu et al. (2026) R. Liu, G. Li, T. Zhang, and S. Ng Image can bring your memory back: a novel multi-modal guided attack against image generation model unlearning. In International Conference on Learning Representations, Vol. 2026, p. 143251–143275. Cited by: §1, §2.2. Liu and Tan (2024) S. Liu and Y. Tan Unlearning concepts from text-to-video diffusion models. arXiv preprint arXiv:2407.14209. Cited by: §2.1. Lu et al. (2026) K. Lu, N. Kriplani, R. Gandikota, M. Pham, D. Bau, C. Hegde, and N. Cohen When are concepts erased from diffusion models?. Advances in Neural Information Processing Systems 38, p. 14751–14775. Cited by: §1, §2.2. Lu et al. (2024) S. Lu, Z. Wang, L. Li, Y. Liu, and A. W. Kong Mace: mass concept erasure in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 6430–6440. Cited by: Table 9, §2.1, Table 1. Lyu et al. (2024) M. Lyu, Y. Yang, H. Hong, H. Chen, X. Jin, Y. He, H. Xue, J. Han, and G. Ding One-dimensional adapter to rule them all: concepts diffusion models and erasing applications. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 7559–7568. Cited by: §2.1. Lyu et al. (2025) X. Lyu, Y. Liu, Y. Li, and B. Xiao Pla: prompt learning attack against text-to-image generative models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 16851–16860. Cited by: §2.2. Matsumoto et al. (2023) T. Matsumoto, T. Miura, and N. Yanai Membership inference attacks against diffusion models. In 2023 IEEE Security and Privacy Workshops (SPW), p. 77–83. Cited by: §1, §2.2. Orgad et al. (2023) H. Orgad, B. Kawar, and Y. Belinkov Editing implicit assumptions in text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 7053–7061. Cited by: §2.1. Petsiuk and Saenko (2024) V. Petsiuk and K. Saenko Concept arithmetics for circumventing concept inhibition in diffusion models. In European Conference on Computer Vision, p. 309–325. Cited by: §1, §2.2. Pham et al. (2023) M. Pham, K. O. Marshall, N. Cohen, G. Mittal, and C. Hegde Circumventing concept erasure methods for text-to-image generative models. arXiv preprint arXiv:2308.01508. Cited by: §1, §2.2. Podell et al. (2023) D. Podell, Z. English, K. Lacey, A. Blattmann, T. Dockhorn, J. Müller, J. Penna, and R. Rombach Sdxl: improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXiv:2307.01952. Cited by: §1. Ranjan et al. (2026) R. Ranjan, U. Grover, X. Lin, and A. Polyzou Razor: ratio-aware layer editing for targeted unlearning in vision transformers and diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 7998–8008. Cited by: §2.1. Rombach et al. (2022) R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, p. 10684–10695. Cited by: §1, §4.1. Rusanovsky et al. (2025) M. Rusanovsky, S. Malnick, A. Jevnisek, O. Fried, and S. Avidan Memories of forgotten concepts. In 2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 2966–2975. Cited by: §1, §2.2. Russakovsky et al. (2015) O. Russakovsky, J. Deng, H. Su, J. Krause, S. Satheesh, S. Ma, Z. Huang, A. Karpathy, A. Khosla, M. Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision 115 (3), p. 211–252. Cited by: §A.1, §A.1, §4.1. Schramowski et al. (2023) P. Schramowski, M. Brack, B. Deiseroth, and K. Kersting Safe latent diffusion: mitigating inappropriate degeneration in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 22522–22531. Cited by: §2.1, §4.1. Somepalli et al. (2023a) G. Somepalli, V. Singla, M. Goldblum, J. Geiping, and T. Goldstein Diffusion art or digital forgery? investigating data replication in diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, p. 6048–6058. Cited by: §2.2. Somepalli et al. (2023b) G. Somepalli, V. Singla, M. Goldblum, J. Geiping, and T. Goldstein Understanding and mitigating copying in diffusion models. Advances in Neural Information Processing Systems 36, p. 47783–47803. Cited by: §2.2. Srivatsan et al. (2025) K. Srivatsan, F. Shamshad, M. Naseer, V. M. Patel, and K. Nandakumar Stereo: a two-stage framework for adversarially robust concept erasing from text-to-image diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 23765–23774. Cited by: Table 9, §2.1, Table 1. Suriyakumar et al. (2024) V. M. Suriyakumar, R. Alur, A. Sekhari, M. Raghavan, and A. C. Wilson Unstable unlearning: the hidden risk of concept resurgence in diffusion models. In ICLR 2025 Workshop on Navigating and Addressing Data Problems for Foundation Models, Cited by: §2.2. Thakral et al. (2025) K. Thakral, T. Glaser, T. Hassner, M. Vatsa, and R. Singh Fine-grained erasure in text-to-image diffusion-based foundation models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 9121–9130. Cited by: §2.1. Tsai et al. (2024) Y. Tsai, C. Hsu, C. Xie, C. Lin, J. Y. Chen, B. Li, P. Chen, C. Yu, and C. Huang Ring-a-bell! how reliable are concept removal methods for diffusion models?. In International Conference on Learning Representations, Vol. 2024, p. 41543–41554. Cited by: §1, §2.2. Wan et al. (2025) T. Wan, A. Wang, B. Ai, B. Wen, C. Mao, C. Xie, et al. Wan: open and advanced large-scale video generative models. arXiv preprint arXiv:2503.20314. Cited by: §4.1. Wang et al. (2025) Y. Wang, O. Li, T. Mu, Y. Hao, K. Liu, X. Wang, and X. He Precise, fast, and low-cost concept erasure in value space: orthogonal complement matters. In 2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 28759–28768. Cited by: §2.1. Wu et al. (2025) J. Wu, T. Le, M. Hayat, and M. Harandi Erasing undesirable influence in diffusion models. In 2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 28263–28273. Cited by: §2.1. Wu et al. (2022) Y. Wu, N. Yu, Z. Li, M. Backes, and Y. Zhang Membership inference attacks against text-to-image generation models. arXiv preprint arXiv:2210.00968. Cited by: §1, §2.2. Xiang et al. (2026) Q. Xiang, M. Zhang, H. Zhang, K. Wang, J. Hou, and L. Nie Tina: text-free inversion attack for unlearned text-to-image diffusion models. arXiv preprint arXiv:2603.17828. Cited by: §1, §2.2. Xu et al. (2024) J. Xu, Z. Wu, C. Wang, and X. Jia Machine unlearning: solutions and challenges. IEEE Transactions on Emerging Topics in Computational Intelligence. Cited by: §1. Xu et al. (2025) N. Xu, J. Zhang, C. Li, Z. Chen, C. Zhou, Q. Li, T. Du, and S. Ji Videoeraser: concept erasure in text-to-video diffusion models. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, p. 5965–5994. Cited by: §2.1, Table 3, Table 3. Yang et al. (2024) Y. Yang, R. Gao, X. Wang, T. Ho, N. Xu, and Q. Xu Mma-diffusion: multimodal attack on diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 7737–7746. Cited by: §1, §2.2. Yang et al. (2025) Z. Yang, J. Teng, W. Zheng, M. Ding, S. Huang, J. Xu, Y. Yang, W. Hong, X. Zhang, G. Feng, et al. CogVideoX: text-to-video diffusion models with an expert transformer. In International Conference on Learning Representations, Cited by: §4.1. [74] Q. Yao, Y. Liu, Z. Wang, Y. Bian, et al. Erasing concept combination from text-to-image diffusion model. In The Thirteenth International Conference on Learning Representations, Cited by: §2.1. Ye et al. (2025) X. Ye, S. Cheng, Y. Wang, Y. Xiong, and Y. Li T2vunlearning: a concept erasing method for text-to-video diffusion models. arXiv preprint arXiv:2505.17550. Cited by: §2.1. Yook et al. (2025) H. J. Yook, G. S. Jhun, J. H. Cho, M. Jeon, D. Kim, T. H. Kim, and Y. K. Lee ZIUM: zero-shot intent-aware adversarial attack on unlearned models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 3926–3935. Cited by: §2.2. Yoon et al. (2025) J. Yoon, S. Yu, V. R. Patil, H. Yao, and M. Bansal Safree: training-free and adaptive guard for safe text-to-image and video generation. In International Conference on Learning Representations, Vol. 2025, p. 56439–56465. Cited by: §2.1. Yuan et al. (2025) X. Yuan, X. Ma, L. Guo, and L. Zhang What lurks within? concept auditing for shared diffusion models at scale. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, p. 4154–4168. Cited by: §2.2. Zhang et al. (2024a) G. Zhang, K. Wang, X. Xu, Z. Wang, and H. Shi Forget-me-not: learning to forget in text-to-image diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, p. 1755–1764. Cited by: Table 9, §2.1, Table 1. Zhang et al. (2025) L. Zhang, Y. Xie, Y. Fu, and P. Chen Concept replacer: replacing sensitive concepts in diffusion models via precision localization. In 2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 8172–8181. Cited by: §2.1. Zhang et al. (2024b) Y. Zhang, X. Chen, J. Jia, Y. Zhang, C. Fan, J. Liu, M. Hong, K. Ding, and S. Liu Defensive unlearning with adversarial training for robust concept erasure in diffusion models. Advances in neural information processing systems 37, p. 36748–36776. Cited by: Table 9, §2.1, Table 1. Zhang et al. (2024c) Y. Zhang, J. Jia, X. Chen, A. Chen, Y. Zhang, J. Liu, K. Ding, and S. Liu To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images… for now. In European Conference on Computer Vision, p. 385–403. Cited by: §1, §2.2. Zhao et al. (2024) M. Zhao, L. Zhang, T. Zheng, Y. Kong, and B. Yin Separable multi-concept erasure from diffusion models. arXiv preprint arXiv:2402.05947. Cited by: §2.1. Appendix A Implementation Details and Evaluation Protocols A.1 Hyperparameter Settings and Implementation Details Self-calibration grid. We select θ=(β,γ,ρ,o)θ=(β,γ,ρ,o) by maximizing the confidence of the initial combined field, as described in Section 3.4. Table 6 lists the candidate values. The predefined finite set Θ is their full Cartesian product, yielding 2×2×3×2=242× 2× 3× 2=24 settings for the main configuration. The selected setting and its group weights remain fixed throughout the search. Candidate gains and their standardization are updated as the selected span expands. Table 6: Self-calibration search grid for the main configuration. Parameter Candidate values Role β 0,1\0,1\ Controls imprint-amplitude weighting through ‖ΔWℓ‖F−2β\| W_ \|_F^-2β. Setting β=0β=0 removes amplitude weighting. γ 0,1\0,1\ Controls background suppression, from no transformation to full regularized whitening. Unit normalization is retained in both cases. ρ 0,0.5,1\0,0.5,1\ Controls spectral shaping within each imprint. o 2,1\2,1\ Specifies the token position relative to the non-padding sequence length for token-based text encodings. For ρ=0ρ=0, spectral reshaping produces the orthogonal projector onto the eigenspace retained by the relative spectral cutoff ε0 _0 in Eq. equation 1. For ρ=1ρ=1, it retains the normalized eigenvalues λ/λmaxλ/ _ above this cutoff. The intermediate setting ρ=0.5ρ=0.5 reduces the disparity between the strengths of retained spectral directions. Token Position Selection. For a text-aware group using token-based text encodings, the offset o specifies the token position used to represent each prompt, as described in Section 3.3. Let L(p)L(p) denote the number of non-padding tokens in prompt p, including special tokens. The zero-based token index is io(p)=maxL(p)−o,0.i_o(p)= \L(p)-o,0\. (7) The position is determined separately for each prompt; larger offsets select earlier positions. For a CLIP sequence consisting of a beginning-of-text token, content tokens, and an end-of-text token, o=1o=1 selects the end-of-text token and o=2o=2 selects the last content token. Other tokenizers use the same index rule with their respective non-padding sequence lengths. Groups using pooled text representations are unaffected by o. Confidence and Erased-Set Size Detection. Table 7 lists the fixed parameters for confidence computation, erased-set size detection, and numerical stabilization. We use κ=0.25κ=0.25 for group weighting, self-calibration, and size estimation, so q1−κq_1-κ in Eq. equation 4 is the 7575th percentile. The search uses a fixed horizon J=96J=96. For size detection, we set B=8B=8 and α=0.30α=0.30: the initial-rise condition requires increases in at least seven of the first eight transitions, and the first sufficiently large decline must reach 30%30\% of the largest log confidence drop. The cutoff follows the rule in Section 3.4. Table 7: Fixed parameters for confidence computation, erased-set size detection, and numerical stabilization in the main configuration. Parameter Value Role κ 0.250.25 Specifies the upper-tail comparison range in the confidence statistic. J 9696 Sets the fixed search horizon. B 88 Sets the window length for the initial-rise condition. α 0.300.30 Sets the relative threshold for the first sufficiently large decline. ε0 _0 10−310^-3 Sets the relative spectral cutoff in Eq. equation 1. εc _c 10−1210^-12 Stabilizes the confidence denominator in Eq. equation 4. εz _z 10−910^-9 Stabilizes gain standardization in Eq. equation 5. εg _g 10−610^-6 Ensures positive group weights in Eq. equation 5. εa _a 10−3010^-30 Keeps logarithms defined in Eq. equation 6. Datasets and Candidate Vocabularies. We construct Imagenette-20 by extending the ten Imagenette classes Howard and others (2019) with ten non-overlapping categories from ImageNet-1k Russakovsky et al. (2015): zebra, giant panda, pizza, banana, airliner, school bus, violin, laptop, submarine, and umbrella. This expanded set enables evaluation across a wider range of erased-set sizes. Artistic-style identification covers the artists evaluated by ESD Gandikota et al. (2023) and UCE Gandikota et al. (2024). The erased concepts are drawn from these evaluation sets, while identification searches a larger candidate vocabulary C. For object recovery, the standard vocabulary contains the 1,000 ImageNet-1k class names Russakovsky et al. (2015). We construct an expanded vocabulary of 73,406 entries by combining these class names with an English word list from GNU Aspell11 1 https://aspell.net/, including its spelling-variant component. This vocabulary covers all 1,000 ImageNet class names under case-insensitive matching and retains multiword names and capitalized proper names. The 70,000-entry vocabulary used in the runtime comparison is a subset of this expanded pool. We will release the complete candidate vocabulary with our code. Probe Selection and Prompt Templates. We use probe words for the representation-matching test in Section 3.2. Each probe is inserted into the applicable prompt templates in T, and its representations are averaged across templates. The test compares the inputs to edited matrices with the corresponding text encodings to distinguish text-aware from text-agnostic imprints. Table 8 lists the template sets used for probe matching and candidate encoding. Each set contains five templates, including one that uses the vocabulary entry without additional text. Each placeholder is replaced with the complete entry. Template averaging reduces sensitivity to phrasing, as described in Section 3.3. Artistic-style experiments are conducted separately with both sets to assess sensitivity to the choice of templates. Table 8: Prompt templates for probe matching and candidate encoding. Each placeholder is replaced with the complete vocabulary entry. Index Object templates Artistic-style templates 1 a photo of a art by 2 3 an image of a painting by 4 a picture of a artwork by 5 a photo of the style of A.2 Extension to Multiword Concept Identification Tracer treats each entry in C as a complete candidate, which may contain multiple words. Identifying a multiword concept already present in C requires no change to the main pipeline. This section describes an iterative search extension that constructs candidate phrases from individual words. The extension uses the text-aware footprint to guide expansion and selects a phrase length without knowing the target length in advance. Candidate Initialization and Expansion. We construct a candidate word vocabulary V from alphabetic CLIP tokenizer entries ending with </w>. Each entry contains at least two characters after removing the marker and is represented by a single token. The initial candidate set (1)C^(1) contains all single-word entries in V. Candidates at expansion round j contain exactly j words. This construction covers phrases whose constituent words are each represented by a retained token. At round j, we retain the b highest-scoring candidates in a set ℬ(j)B^(j). Each retained candidate is expanded by inserting a word from V at every possible position: (j+1)=Insert(c,v,i)|c∈ℬ(j),v∈,i=0,…,j.C^(j+1)= \Insert(c,v,i)\, |\,c ^(j),\ v ,\ i=0,…,j \. (8) Here, Insert(c,v,i)Insert(c,v,i) inserts v after the first i words of c, including before the first word and after the last. Duplicate sequences are removed, while distinct word orders remain separate candidates. Expansion draws from the full vocabulary V, allowing words with low individual scores to contribute to a phrase. Phrase Encoding and Footprint Scoring. At expansion round j, each candidate c=(v1,…,vj)∈(j)c=(v_1,…,v_j) ^(j) is encoded as [BOS,v1,…,vj,EOS][BOS,v_1,…,v_j,EOS], where BOSBOS and EOSEOS mark the beginning and end of the sequence. We extract the CLIP hidden state at the final content-token position, corresponding to vjv_j. Causal attention allows this representation to incorporate all preceding words. The extension uses the bare phrase with a fixed extraction position, without template averaging or token-offset search. We center the candidate representations, apply regularized covariance whitening with exponent γ, and perform ℓ2 _2 normalization. The resulting unit vector for candidate c at round j is denoted by x~c(j) x_c^(j). The mean and covariance are recomputed over (j)C^(j) at each expansion round. The initial single-word representations can be reused across checkpoints sharing the same base text encoder and preprocessing settings. Following Section 3.2, we fuse spectrally reshaped weight footprints within the compatible text-aware group to construct GgtxtG_g_txt. This extension uses the 768768-dimensional CLIP input space. Each candidate is scored by s(j)(c)=(x~c(j))⊤Ggtxtx~c(j).s^(j)(c)= ( x_c^(j) ) G_g_txt x_c^(j). (9) The quadratic form measures the footprint energy along the candidate’s normalized representation. Dividing it by tr(Ggtxt)tr(G_g_txt) gives the singleton subspace coverage in this group. We use the unnormalized score and standardize it within each round as described below. Cross-Length Comparison and Stopping. We standardize candidate scores within each expansion round and apply a length penalty: u(j)(c)=s(j)(c)−μs(j)σs(j)+εz−λ(j−1),u^(j)(c)= s^(j)(c)- _s^(j) _s^(j)+ _z-λ(j-1), (10) where j denotes the current expansion round and the number of words in each candidate. The quantities μs(j) _s^(j) and σs(j) _s^(j) are the mean and standard deviation of scores over (j)C^(j), and εz _z stabilizes the denominator. The standardized term measures a candidate’s prominence relative to other candidates of the same word length. The coefficient λ penalizes each additional word beyond the first. Within a round, this transformation preserves candidate rankings and therefore leaves beam selection unchanged. Let cj⋆=argmaxc∈(j)u(j)(c)c_j = _c ^(j)u^(j)(c) denote the highest-scoring candidate at round j. We initialize the best phrase with c1⋆c_1 . For each subsequent round j≥2j≥ 2, we update the best phrase only when u(j)(cj⋆)>max1≤q<ju(q)(cq⋆),u^(j)(c_j )> _1≤ q<ju^(q)(c_q ), (11) where q indexes preceding expansion rounds and cq⋆c_q is the highest-scoring candidate at round q. This condition requires the current round’s best penalized score to exceed the best score from all preceding rounds. If it holds, we retain cj⋆c_j and continue expansion unless the maximum permitted length has been reached. Otherwise, the search stops and returns the best phrase from the preceding rounds. We use a beam size of b=8b=8, a length penalty of λ=0.05λ=0.05, and a maximum of three words. This stopping rule selects the word length of an individual candidate. It is separate from erased-set size detection, which estimates the number of erased concepts. Cross-length comparison is heuristic because both the representation statistics and score distributions change across rounds. The search may therefore return a shorter phrase even when the complete target has been generated. A.3 Baseline Implementations We compare Tracer with brute-force generation probing and an adapted membership inference attack (Kong et al., 2024). Both baselines assign a score to each candidate c∈c based on changes between the public base model W and the unlearned model W′W . Candidates are ranked in descending order of these scores. Brute-Force Generation Probing. This baseline evaluates whether a candidate concept becomes less evident in generated images after unlearning. For each candidate c, we construct prompts containing the complete candidate name and generate images using both W and W′W . Let ℐW(c)I_W(c) and ℐW′(c)I_W (c) denote the corresponding image sets. We score the candidate by the decrease in average concept evidence: sBF(c)=1|ℐW(c)|∑I∈ℐW(c)a(I,c)−1|ℐW′(c)|∑I∈ℐW′(c)a(I,c),s_BF(c)= 1|I_W(c)| _I _W(c)a(I,c)- 1|I_W (c)| _I _W (c)a(I,c), (12) where a(I,c)a(I,c) measures the evidence for concept c in image I. A larger score indicates a greater decline in the model’s ability to generate the candidate concept. The same evaluation function is used for both models. This procedure requires image generation for every candidate in C. Changes in generated content may also reflect effects on related non-target concepts, which can receive high scores despite not being directly targeted. Adapted Membership Inference Attack. We adapt PIA Kong et al. (2024) from sample-level membership inference to concept-level identification. For each candidate c, let cX_c denote its associated evaluation samples. We apply the PIA error statistic to the same samples under W and W′W and aggregate the differences: sPIA(c)=1|c|∑x∈c[rW′(x,c)−rW(x,c)],s_PIA(c)= 1|X_c| _x _c [r_W (x,c)-r_W(x,c) ], (13) where rW(x,c)r_W(x,c) denotes the sample-level PIA error computed using model W with concept conditioning c. A larger score indicates a greater increase in error after unlearning. Averaging over cX_c converts the sample-level changes into a single candidate score. The adaptation ranks concepts by changes in the PIA statistic rather than making binary membership decisions for individual samples. Its concept scores may capture both direct erasure effects and changes affecting non-target concepts. Appendix B Additional Experimental Results Table 9 reports the identification accuracy of erased artistic styles across three text-to-image backbones. Tracer achieves perfect identification in nearly all evaluated settings. On Stable Diffusion v1.5, ESD reaches 92%92\% when ten styles are erased jointly, yielding an average accuracy of 98.0%98.0\%. All other evaluated configurations achieve 100%100\% accuracy. UCE, ScaPre, and FIA maintain perfect identification with twenty jointly erased styles. These results demonstrate that weight footprints reveal erasure targets beyond object concepts, extending to artistic styles across different backbones and unlearning methods. Table 9: Identification accuracy (%) of erased artistic styles across three text-to-image backbones. K denotes the number of jointly erased styles. Shaded cells report evaluated results. “–” indicates an unevaluated setting. Avg. is the arithmetic mean over evaluated settings within each row. Erased-set size K Method Venue 1 3 5 10 20 Avg.↑\, Stable Diffusion v1.5 ESD ICCV 2023 100 100 100 92 – 98.0 UCE WACV 2024 100 100 100 100 100 100.0 MACE CVPR 2024 100 100 100 100 – 100.0 FMN CVPR 2024a 100 100 100 – – 100.0 ConceptPrune ICLR 2024 100 100 100 100 – 100.0 Sculpting ICCV 2025b 100 100 100 100 – 100.0 SPEED ICLR 2025c 100 100 – – – 100.0 ScaPre ICLR 2026b 100 100 100 100 100 100.0 FIA ICML 2026a 100 100 100 100 100 100.0 AdvUnlearn NeurIPS 2024b 100 – – – – 100.0 STEREO CVPR 2025 100 100 – – – 100.0 Meta-Unlearning ICCV 2025b 100 – – – – 100.0 Stable Diffusion 3 UCE WACV 2024 100 100 100 – – 100.0 EraseFlow NeurIPS 2026 100 100 100 – – 100.0 FLUX.1 EraseAnything ICML 2025a 100 100 – – – 100.0 ScaPre ICLR 2026b 100 100 100 100 – 100.0 We exclude facial-identity unlearning from this evaluation. In our preliminary checks, the tested methods suppress target identities but also degrade the generation of non-target content. These checkpoints therefore provide a limited basis for evaluating target identification under selective unlearning, as their weight changes also reflect broader losses in generative capability. Appendix C Code Sources for Unlearning and Attack Methods We list the public code repositories for the unlearning methods and the MIA baseline used in our experiments. • ESD: https://github.com/rohitgandikota/erasing • UCE: https://github.com/rohitgandikota/unified-concept-editing • MACE: https://github.com/Shilin-LU/MACE • FMN: https://github.com/SHI-Labs/Forget-Me-Not • SPM: https://github.com/THU-MIG/SPM • ConceptPrune: https://github.com/ruchikachavhan/concept-prune • Sculpting: https://github.com/coulsonlee/Sculpting-Memory-ICCV-2025 • SPEED: https://github.com/Ouxiang-Li/SPEED • ScaPre: https://github.com/kaiyuan02415/ScaPre • FIA: https://github.com/kaiyuan02415/Forget-It-All • AdvUnlearn: https://github.com/OPTML-Group/AdvUnlearn • STEREO: https://github.com/koushiksrivats/robust-concept-erasing • Meta-Unlearning: https://github.com/sail-sg/Meta-Unlearning • EraseFlow: https://github.com/Abhiramkns/EraseFlow • EraseAnything: https://github.com/tomguluson92/EraseAnything • Refusal: https://github.com/4idrossifenil-etanammide/Video-Unlearning • VideoEraser: https://github.com/bluedream02/VideoEraser • SAFREE: https://github.com/jaehong31/SAFREE • MIA baseline (PIA): https://github.com/kong13661/PIA