TINA: Text-Free Inversion Attack for Unlearned Text-to-Image Diffusion Models

Qianlong Xiang; Miao Zhang; Haoyu Zhang; Kun Wang; Junhui Hou; Liqiang Nie

cs.CVMar 18, 2026

TINA: Text-Free Inversion Attack for Unlearned Text-to-Image Diffusion Models

Authors: Qianlong Xiang, Miao Zhang, Haoyu Zhang, Kun Wang, Junhui Hou, Liqiang Nie

Organizations: Harbin Institute of Technology (Shenzhen) · City University of Hong Kong · Shenzhen Loop Area Institute · Peng Cheng Laboratory ·

Abstract

Although text-to-image diffusion models exhibit remarkable generative power, concept erasure techniques are essential for their safe deployment to prevent the creation of harmful content. This has fostered a dynamic interplay between the development of erasure defenses and the adversarial probes designed to bypass them, and this co-evolution has progressively enhanced the efficacy of erasure methods. However, this adversarial co-evolution has converged on a narrow, text-centric paradigm that equates erasure with severing the text-to-image mapping, ignoring that the underlying visual knowledge related to undesired concepts still persist. To substantiate this claim, we investigate from a visual perspective, leveraging DDIM inversion to probe whether a generative pathway for the erased concept can still be found. However, identifying such a visual generative pathway is challenging because standard text-guided DDIM inversion is actively resisted by text-centric defenses within the erased model. To address this, we introduce TINA, a novel Text-free INversion Attack, which enforces this visual-only probe by operating under a null-text condition, thereby avoiding existing text-centric defenses. Moreover, TINA integrates an optimization procedure to overcome the accumulating approximation errors that arise when standard inversion operates without its usual textual guidance. Our experiments demonstrate that TINA regenerates erased concepts from models treated with state-of-the-art unlearning. The success of TINA proves that current methods merely obscure concepts, highlighting an urgent need for paradigms that operate directly on internal visual knowledge.

Figures & tables

Figure 1: Conceptual overview of text-centric erasure vulnerabilities and our TINA attack. Concept Erasure usually severs the link between a specific text condition and the undesired concept. Previous Attacks remain text-centric, finding adversarial text condition to reactivate the concept. Our TINA bypasses the text pathway entirely. Using an empty text condition, it finds a noise to regenerate the concept, proving the visual knowledge persists in the existing erased models.

Figure 2: The TINA (Text-free INversion Attack) framework. (a) Text-Free Inversion Attack: An optimization-based, null-text ( $c_{\text{null}}$ ) inversion finds the unique initial noise $z_{T}^{*}$ corresponding to a target image $z_{0}$ . This optimization corrects the errors from standard inversion. (b) Deterministic Concept Regeneration: The same sanitized model $\theta$ uses $z_{T}^{*}$ and $c_{\text{null}}$ to deterministically regenerate the target concept $z_{0}^{\prime}$ , proving the visual knowledge persists despite erasure.

Figure 3: Standard DDIM inversion fails to find the generative trajectory. The text-guided path ( $S$ ) is blocked by the erasure, while the null-text path ( $S^{\emptyset}$ ) drifts due to approximation errors, failing to restore the target concept.

Figure 4: Qualitative comparison of attack performance on (a) Nudity Erasure and (b) Style Erasure (Van Gogh). Images with a red border indicate a successful attack. Our TINA (bottom row) consistently regenerates the forbidden concepts, bypassing most of defenses, while text-centric attacks fail against robust methods. Sensitive content is redacted.

	ESD [ 6 ]	FMN [ 52 ]	UCE [ 7 ]	MACE [ 20 ]	RECE [ 8 ]	AdvUnlearn [ 56 ]	SalUn [ 5 ]	STEREO [ 38 ]
MMA [ 51 ]	13.10	67.00	32.60	6.00	22.80	1.70	1.70	5.50
P4D [ 4 ]	69.01	97.89	76.06	75.35	66.20	18.31	15.49	24.65
UDA [ 57 ]	76.05	97.89	78.87	81.69	63.38	23.24	13.38	25.35
RAB [ 39 ]	50.53	97.89	29.47	6.32	10.53	2.11	0.00	8.42
CCE [ 27 ]	74.65	54.93	49.30	50.00	66.90	76.76	2.82	16.90
TINA	82.39	97.89	82.39	92.96	80.28	78.87	71.13	80.99

Table 1: Quantitative comparison of Attack Success Rates (ASR, in %) on the nudity erasure task. We evaluate our TINA against five baselines across eight prominent unlearning defenses. Bold indicates the best-performing attack.

	ESD [ 6 ]	FMN [ 52 ]	AC [ 15 ]	MACE [ 20 ]	SPM [ 21 ]	RECE [ 8 ]	AdvUnlearn [ 56 ]	STEREO [ 38 ]
P4D [ 4 ]	30.0	54.0	68.0	42.0	78.0	62.0	0.0	0.0
UDA [ 57 ]	32.0	56.0	77.0	56.0	88.0	64.0	2.0	0.0
CCE [ 27 ]	8.0	18.0	14.0	26.0	36.0	40.0	44.0	4.0
TINA	70.0	72.0	74.0	72.0	80.0	74.0	70.0	44.0

Table 2: Comparison of Attack Success Rates (ASR, in %) on the artistic style erasure task. We report the performance of our TINA against three baselines across eight unlearning methods. Bold denotes the highest ASR, while underlined denotes the second highest.

	MMA	P4D	UDA	RAB	CCE
Nudity	✓	✓	✓	✓	✓
Style	✗	✓	✓	✗	✓
Object	✗	✓	✓	✗	✓

Table 3: Applicability of baseline attack methods to different tasks. ✓ denotes applicability, while ✗ denotes non-applicability.

	P4D	UDA	CCE	TINA
ESD [ 6 ]	32.0	46.0	40.0	70.0
EraseDiff [ 48 ]	8.0	2.0	34.0	68.0
SalUn [ 5 ]	18.0	12.0	58.0	72.0
Scissorhands [ 47 ]	6.0	6.0	0.0	78.0
STEREO [ 38 ]	0.0	2.0	2.0	72.0

Table 4: Attack Success Rates (ASR, in %) for object erasure. Our TINA bypasses modern defenses where text-centric attacks fail.

Figure 5: t-SNE visualization of (a) the optimized initial noises

z_{T}^{*}

and (b) their corresponding deep UNet activations (extracted from the mid_block ) for four erased concepts.

Figure 6: Ablation study of attack results on the ESD method for tench object erasure. From left to right: target concept, Standard Inv. (standard text-guided inversion), TINA-Less (with insufficient optimization), and our full TINA method.

Figure 7: Visual comparison between naive null-text DDIM inversion and our optimized TINA inversion on the Van Gogh style erasure task. While the naive null-text DDIM inversion can roughly recover the global composition, it often fails to preserve fine-grained stylistic details, such as brushstroke textures and local structures. In contrast, TINA produces reconstructions with noticeably richer and more faithful visual details.

	EasyInv [ 58 ]	TINA
ESD [ 6 ]	24.0	70.0
EraseDiff [ 48 ]	26.0	68.0
SalUn [ 5 ]	30.0	72.0
Scissorhands [ 47 ]	34.0	78.0
STEREO [ 38 ]	24.0	72.0

Table 5: Attack Success Rates (ASR, in %) comparison between EasyInv and our TINA on the tench object erasure task. Both methods operate under a text-free condition. Bold indicates the best-performing method.

Figure 8: Generalization of TINA to a DiT-based architecture ( PixArt-XL-2-512x512 ). We erase the “Parachute” concept using ESD and then apply TINA. While the erased model fails to generate parachutes, TINA successfully recovers the concept, demonstrating architecture-agnostic generalizability.

Figure 9: Failure cases of TINA on the STEREO style erasure (Van Gogh) task. While TINA preserves the spatial composition of the target images, the reconstructed results fail to recover the distinctive artistic style, indicating that the adversarial training procedure of STEREO partially disrupts the style-specific visual knowledge.

Figure 10: Qualitative comparison of attack methods on the nudity erasure task. Each row corresponds to an attack method, and each column corresponds to an unlearning defense. Sensitive content is redacted.

Figure 11: Qualitative comparison of attack methods on the “Van Gogh” style erasure task. Each row represents an attack, and each column represents a specific unlearning defense.

T2I Diffusion Models

Text-to-image (T2I) diffusion models generate images from prompts by learning to reverse noise under text conditioning.

See all 403 papers

TINA+: Probing Residual Visual Knowledge in Unlearned Diffusion Models via Diffusion-Consistent Text-Free Inversion
Aug 18, 2026Qianlong Xiang, Miao Zhang, Kun Wang +3T2I Diffusion Models Diffusion Model Unlearning
School of Computer Science and Technology, Harbin Institute of Technology (Shenzhen), Shenzhen 518055, China · City University of Hong Kong, Hong Kong SAR, China · Shenzhen Loop Area Institute, Shenzhen 518045, China +4
TEA: Text Encoder Alignment for Robust Concept Erasure in Text-to-Image Models
Aug 15, 2026Alireza Dehghanpour Farashah, Zhuan Shi, Negar Rostamzadeh +1Safe T2I Generation Adversarial Robustness
Mila – Quebec AI Institute · McGill University · Google Research
VisualErase: Dual-Branch Visual Trajectory Redirection for Robust Concept Erasure in Text-to-Image Diffusion Models
Oct 4, 2026Qianlong Xiang, Miao Zhang, Kun Wang +3Diffusion Model Unlearning T2I Diffusion Models
Harbin Institute of Technology (Shenzhen) · City University of Hong Kong · Shenzhen Loop Area Institute +2

Aug 18, 2026J/K move · Enter open · S save

TINA+: Probing Residual Visual Knowledge in Unlearned Diffusion Models via Diffusion-Consistent Text-Free Inversion

Qianlong Xiang, Miao Zhang, Kun Wang, Haoyu Zhang+2

School of Computer Science and Technology, Harbin Institute of Technology (Shenzhen), Shenzhen 518055, China · City University of Hong Kong, Hong Kong SAR, China · Shenzhen Loop Area Institute, Shenzhen 518045, China+4

T2I Diffusion Models Diffusion Model Unlearning Diffusion Model Inversion

Open paper AskPDF arXiv

Although text-to-image diffusion models exhibit remarkable generative power, concept erasure techniques are essential for preventing harmful content. Existing adversarial probes evaluate these methods by testing whether erased concepts can still be recovered. However, existing erasure and probe methods remain largely text-centric, focusing on whether the text-to-image mapping is severed while overlooking whether the corresponding visual knowledge remains. To investigate this question from a visual perspective, we leverage diffusion inversion to probe whether a generative trajectory can reconstruct visual instances of an erased concept. Under a null-text condition, standard inversion avoids the textual pathway but amplifies approximation errors, hindering faithful trajectory recovery. To address this challenge, we introduce TINA+, a diffusion-consistent Text-free INversion Attack equipped with optimization-based inversion. We also find that unconstrained diffusion inversion may discover spurious trajectories, even allowing a randomly initialized diffusion model to reconstruct the target concept. Such trajectories may falsely indicate residual visual knowledge. TINA+ therefore introduces Diffusion-Consistent Trajectory Regularization to suppress this failure mode. By penalizing trajectories that fall far below the expected marginal energy evolution of diffusion, TINA+ suppresses spurious inversion paths while preserving its ability to recover erased concepts. Experiments across twelve erasure methods, four concept-erasure tasks, and different model architectures demonstrate that TINA+ reliably probes residual visual knowledge through diffusion-consistent visual trajectories. These results provide stronger evidence that current methods often obscure concepts by severing text-image links rather than eliminating the underlying visual knowledge.

Abstract

T2I Diffusion Models

Explore similar work

TINA+: Probing Residual Visual Knowledge in Unlearned Diffusion Models via Diffusion-Consistent Text-Free Inversion

TEA: Text Encoder Alignment for Robust Concept Erasure in Text-to-Image Models

VisualErase: Dual-Branch Visual Trajectory Redirection for Robust Concept Erasure in Text-to-Image Diffusion Models