{"id":"053452fd-d7ea-40b1-9d83-8d77d43f55bf","arxiv_id":"2507.21985","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"ZIUM attacks unlearned diffusion models by optimizing an image-captioning module that turns a target image into a text embedding, then reuses that module zero-shot on unseen images of the same unlearned concept.","lead":"ZIUM is an attack that makes unlearned text-to-image models reproduce removed concepts by converting a target image into a text condition, then reuses that converter on new images of the same concept. It reports much higher attack success rates and repeat attacks that are tens to hundreds of times faster than prior prompt-search attacks.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Zero-shot transfer claim is unsubstantiated: no held-out split is defined, no variance is reported, and the evaluation does not verify that fθ' transfers to unseen images rather than emitting a universal concept embedding.","rationale":"The paper's central contribution is a zero-shot attack for unlearned diffusion models, relying on the transfer of an optimized visual-text alignment module fθ' to unseen target images. The reader's weakest assumption identifies exactly this transfer. My stress-test concurs and sharpens it: the paper does not specify the data split between initial optimization and zero-shot evaluation (Section 3.2, Table 2), does not report variance or multiple seeds, and does not quantify whether the generated zero-shot images actually resemble the unseen target input. The quantitative ASR drops from initial to zero-shot for Van Gogh (86 to 50) and parachute (76 to 48) suggest meaningful degradation, yet no analysis of failure modes is offered. A further risk is that fθ' may have collapsed to a universal adversarial text embedding that triggers the unlearned concept for any input image; in that case the attack would still achieve ASR but would not provide the claimed customization to the unseen image, weakening the novelty of the 'intent-aware zero-shot' contribution. The test I propose, varying the initial image choice, reporting held-out ASR variance, and comparing image similarity against a universal embedding baseline, would settle whether the transfer is genuine and whether the customization is real. Since the reader already marked CONDITIONAL on the same basis, no verdict change is needed.","tokens_in":14040,"tokens_out":6452,"duration_ms":65893,"concrete_test":"Run a held-out zero-shot evaluation with 10 different initial images per concept: for each concept (nudity, Van Gogh, parachute), generate 50 target images; for each of 10 randomly chosen initial images, optimize fθ' on that image, then evaluate ASR on the remaining 40 held-out images. Report mean and standard deviation of ASR across the 10 runs, and also compute the average LPIPS or CLIP image similarity between the zero-shot generated images and their corresponding input target images. If the ASR variance is high, or if the image similarity is not significantly better than a universal text embedding control, the zero-shot transfer and customization claims are unsupported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that after optimizing fθ' in the initial attack phase (§3.1.2, Eq. 7) on one target image, the same fθ' can attack unseen target images of the same unlearned concept without further optimization (§3.2). This requires fθ' to generalize across images. The paper's evidence, Table 2, reports ZIUM (Zero-shot) ASR of 84.5% (nudity), 50.0% (Van Gogh), and 48.0% (parachute) on ESD, but never states how the initial and zero-shot images were split, how many images were used to optimize fθ', whether the zero-shot test images were disjoint from the optimization set, or whether the same user-intent prompt was used in both phases. Without a defined held-out split, the zero-shot evaluation may leak images from the optimization distribution. Moreover, the drop from initial to zero-shot ASR (e.g., 86% to 50% for Van Gogh) is large, yet no error bars, multiple seeds, or failure-case analysis are provided, so the transfer claim is not statistically supported. Finally, the qualitative examples in Fig. 4(d)-(f) claim that the zero-shot generation preserves characteristics of the unseen target image, but no quantitative image-similarity metric is reported; it is possible that fθ' has collapsed to a universal adversarial text embedding that triggers the unlearned concept regardless of the input image, which would undermine the 'intent-aware' and 'customized' aspects of the zero-shot claim. The fitting-versus-prediction gap is the core risk: Eq. 7 fits fθ' to reconstruct x_i, and generalization to x_j is assumed without evidence.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes ZIUM, a two-phase adversarial attack against unlearned text-to-image diffusion models. In the initial phase, a visual-text alignment module (a frozen visual encoder plus an optimized Q-former and projection layer) maps a target attack image into a text embedding, which is concatenated with a user-intent prompt and used as a conditioning signal to generate images containing the unlearned concept; the module is optimized with a diffusion-classifier objective (Eq. 7). In the zero-shot phase, the same optimized module is reused on unseen target images and prompts without further optimization. Experiments on ESD, FMN, SLD, and AdvUnlearn across nudity, violence, illegal activity, style, and object concepts report high attack success rates (e.g., 87.8% average in Table 1) and large reductions in attack time (Table 2).","tokens_in":14394,"tokens_out":4321,"duration_ms":47277,"significance":"If the zero-shot transfer claim is valid, ZIUM would be a meaningful advance in adversarial attacks on unlearned diffusion models, reducing per-attack optimization cost substantially while retaining high success rates. The use of an image-captioning module for adversarial conditioning is a novel idea, and the paper covers multiple unlearned models and concept classes, which is a strength. However, the central claim is currently under-supported: the zero-shot evaluation lacks a defined held-out split and any statistical uncertainty quantification, and the qualitative customization claims are not quantified. The contribution is promising but requires a substantially strengthened evaluation before it can be considered established.","major_comments":[{"comment":"The zero-shot claim, which is the paper's main contribution, requires a clearly defined held-out evaluation, but the manuscript never states how the target attack images were split between the initial-phase optimization set and the zero-shot test set, how many images were used to optimize f_theta', or whether the same user-intent prompts were used in both phases. Without this information, the zero-shot ASR values in Table 2 (84.5% for nudity, 50.0% for Van Gogh, 48.0% for parachute) cannot be distinguished from in-distribution results, and the claim that the optimized module generalizes to unseen images is unsubstantiated. The authors must report the exact split, the per-concept optimization set size, and a confirmation that the test images are disjoint from the optimization set.","section":"Section 3.2 / Table 2"},{"comment":"No variance, confidence intervals, or multiple seeds are reported for any ASR number. With only 50 prompts for Van Gogh and parachute, the differences between ZIUM zero-shot (50.0% and 48.0%) and UnlearnDiffAtk (36.0% and 48.0%) may not be statistically meaningful, and the claim that zero-shot outperforms all existing methods is not supported. The authors should provide error bars or significance tests, and ideally repeat the initial-phase optimization over several seeds to show the sensitivity of the learned module.","section":"Section 4.2.3 / Table 2"},{"comment":"The initial-phase ASR is a fitted result, not a prediction: Eq. (7) directly minimizes the denoising error on the target attack image x_i, and Table 1 reports ASR on images generated from the same optimization setting. The paper should explicitly frame Table 1 as in-distribution fitting performance and Table 2 as the held-out transfer result. It should also clarify whether baseline methods are given an analogous optimization budget (e.g., number of steps and prompts per image) so that the comparison in Table 1 is fair.","section":"Sections 3.1.2 and 4.2.1 / Eq. (7) and Table 1"},{"comment":"For violence and illegal activity, the authors filter the I2P dataset to only prompts where the Q16 classifier deems more than 50% of generated images inappropriate, keeping only 334 of 756 and 248 of 727 prompts respectively. This is a biased subsample that can inflate absolute ASR values and may affect relative method rankings if the discarded prompts behave differently. The authors should justify this filtering or also report results on the full I2P set to allow comparison with prior work.","section":"Section 4.1 (Prompt Datasets)"},{"comment":"Qualitative claims such as 'perfectly reflected the nudity concept' and 'successfully generates customized images' are based only on visual inspection; no quantitative similarity metric, concept-preservation metric, or user-intent-alignment metric is provided. For the customization claims (RQ#2 and the zero-shot customization shown in Fig. 4), some quantitative evidence is needed to rule out the possibility that the optimized f_theta' has collapsed to a universal adversarial text embedding that triggers the unlearned concept regardless of the input image, which would undermine the 'intent-aware' and 'customized' aspects of the contribution.","section":"Sections 4.2.1, 4.2.2, and Appendix A1"}],"minor_comments":[{"comment":"The concatenation of the L-dimensional text embedding with the user-intent prompt embedding is not dimensionally specified; please clarify how the two embeddings are combined (e.g., along the sequence dimension) and how the combined condition is processed by the CLIP text encoder.","section":"Section 3.1.1"},{"comment":"The heading 'Acknowledegments' contains a typo and should be corrected to 'Acknowledgments'.","section":"Acknowledgments"},{"comment":"The column header 'V a vg.' appears malformed; it should be 'Avg.'.","section":"Table 1"},{"comment":"Reference [33] lists page numbers inconsistently (the citation appears as both page 1 and with other page ranges); please check the reference formatting.","section":"References"},{"comment":"The text acknowledges that for illegal activity, church, and parachute, ZIUM produced 'comparable results' rather than superior results, with differences of about two or three images per concept; this caveat should be reflected in the abstract's 'superior attack success rate' claim, which currently overstates the consistency of the advantage.","section":"Section 4.2.1"}],"recommendation":"major_revision","confidential_remarks":"The paper fits the journal's scope and addresses a timely problem, but the evaluation is not yet rigorous enough for publication. The most important missing piece is a precise description of the zero-shot evaluation protocol, including the train/test split and the number of optimization images; without this, the central claim cannot be assessed. The lack of variance reporting and the biased prompt filtering are also concerns. I would be willing to reconsider a revised version that adds these details and provides quantitative support for the customization claims."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The genuinely new thing here is the per-concept visual-to-text alignment module: a BLIP2 Q-former plus projection layer, optimized with a diffusion-classifier objective, then reused zero-shot on unseen images of the same unlearned concept. That is a real idea and worth engaging with. The paper also does the right thing by comparing against standard baselines and including a no-attack condition, and the qualitative examples show that user-intent customization works in at least some cases.\n\nThe soft spots are mostly in the evidence for the zero-shot claim, which is the load-bearing contribution. Table 2 reports zero-shot ASR of 84.5%, 50.0%, and 48.0% for nudity, Van Gogh, and parachute, but the paper never states how the initial-phase images and zero-shot test images were split, how many images were used to optimize the module, or whether the test images were disjoint from the optimization set. Without that, the zero-shot numbers could be partly in-distribution. There are also no error bars or multiple seeds, and the drop from initial to zero-shot ASR is large (Van Gogh 86% to 50%), so the transfer claim is not statistically supported. The initial-phase ASR in Table 1 is also partly a fitted value: Eq. 7 optimizes the module to minimize denoising error on the attack images, and the paper does not clearly separate fitting from held-out evaluation for that phase.\n\nTwo smaller issues: the violence and illegal activity prompt sets are filtered by Q16 threshold (only prompts with >50% inappropriate-image proportion are kept), which could inflate ASR relative to an unfiltered test set, and the qualitative language like \"perfectly reflected\" overstates what static images can show. The stress-test worry about the module collapsing to a universal concept embedding is legitimate; no image-similarity or failure-case analysis rules it out.\n\nThat said, the idea deserves a serious referee. The combination of a pretrained captioning module with a learned projection for attacking unlearned models is novel enough, and the zero-shot mechanism has clear practical value for auditing concept erasure. I would send it to peer review, but the authors need to release code, define the optimization/evaluation split, report variance across seeds, and analyze transfer failures. Until then, I would treat the reported numbers as preliminary rather than established.","headline":"Clever per-concept alignment module and a promising zero-shot attack idea, but the evaluation doesn't yet prove the transfer claim.","tokens_in":14926,"tokens_out":1661,"would_cite":false,"duration_ms":21941,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Adversarial attacks on unlearned image models can be made zero-shot and intent-aware by optimizing a single captioning-plus-projection module per removed concept.","keywords":["machine unlearning","text-to-image diffusion models","adversarial attacks","zero-shot attack","concept erasure","user intent customization","diffusion classifier","image captioning"],"falsifier":"Run the initial per-concept attack on a single target image, freeze the resulting module, and evaluate it on held-out target images drawn from a deliberately different visual distribution (for example, heavily compressed images, artwork, or synthetic avatars). If the zero-shot attack success rate on that held-out set drops to the no-attack level while remaining high on near-distribution images, the zero-shot claim is conditional on visual similarity rather than general.","tokens_in":13872,"feed_emoji":"🎯","tokens_out":10661,"duration_ms":112686,"temperature":0.7,"pith_summary":"ZIUM claims that an attacker can defeat concept-erasing machine unlearning in text-to-image models with almost no per-attack cost. The method takes a target attack image that still contains the removed concept, converts its visual embedding into a text embedding through an image-captioning and projection module, and concatenates that embedding with the text embedding of a user-intent prompt. A one-time optimization of the captioning and projection modules per unlearned concept makes the attack zero-shot: after that single optimization, unseen target images and new user-intent prompts for the same concept can be attacked without further optimization. The paper reports an average attack success rate of 87.8%, compared with 65.2% for the strongest existing baseline, and zero-shot attacks that run roughly 45 to 150 times faster than re-optimizing per attack. If true, this means unlearning a concept is not enough to stop cheap, customizable regeneration of it.","feed_headline":"Unlearned image models fall to a zero-shot intent-aware attack","feed_subtitle":"After one per-concept optimization, unseen images and prompts are attacked with no extra tuning, at up to 149x lower cost.","key_machinery":"The load-bearing object is the visual-text alignment network $f_{\\theta'}$: a frozen visual encoder that extracts a $k$-dimensional embedding from the target attack image, a query-based image-captioning module pretrained with image-text contrastive, image-text matching, and image-grounded text-generation losses, and a trainable projection layer that maps the resulting text embedding to the dimension expected by the unlearned diffusion model's text encoder. Its parameters are the only ones updated during the initial attack. The zero-shot claim rests entirely on $f_{\\theta'}$ generalizing the unlearned concept across images: once optimized on one image of the concept, the same frozen network is expected to turn any unseen image containing that concept into a usable conditioning embedding.","core_discovery":"On its own terms, ZIUM's central discovery is that the expensive part of an adversarial attack on an unlearned diffusion model can be moved into a reusable per-concept adapter. For each removed concept, ZIUM optimizes only the parameters $\\theta'$ of the image-captioning-plus-projection network so that the condition $c_i = f_{\\theta'}(E(x_i))$, concatenated with the user-intent prompt embedding $p$, minimizes the expected denoising error $\\mathbb{E}_{t,\\epsilon} \\| \\epsilon - \\epsilon_\\theta(x_t \\mid f_{\\theta'}(e_i), p) \\|_2^2$ of the unlearned model. After this initial attack phase, the optimized $f_{\\theta'}$ is frozen and applied to any unseen target image of the same concept, which is what the paper calls the zero-shot attack phase. The reported result is consistently high attack success across nudity, violence, illegal activity, style, and object scenarios, with an average of 87.8% against four representative unlearned models, and zero-shot attack time near 0.2 minutes.","pith_inferences":["Editorial inference: the reusable per-concept adapter behaves like a concept-level direction in the model's embedding space; if so, probing that direction with held-out images could predict when zero-shot transfer will fail, which the paper does not analyze.","Editorial inference: the same optimization only requires a differentiable denoising objective and a text-conditioning interface, so the mechanism should transfer to other conditional generative models such as image-to-image or video generators.","Editorial inference: a direct test of generality would be to run the initial attack on one image of a concept and then evaluate the frozen module on target images drawn from a deliberately different distribution, such as heavy compression, different art styles, or synthetic avatars; the paper reports averages but not failure distribution."],"forward_implications":["After one optimization per removed concept, an attacker can run new attacks on unseen target images and new user-intent prompts with no further optimization.","Zero-shot attack time falls to roughly 0.2 minutes per attack, compared with 9 to 30 minutes for methods that re-optimize each attack.","Attack success becomes more consistent across unlearned models and concept categories: ZIUM averages 87.8% with 39.4 percentage points of variation, while existing methods vary by at least 62.0 points.","User-intent prompts change backgrounds, objects, styles, and behaviors of the regenerated image while the removed concept is preserved, so attacks are customizable rather than fixed to one image."],"supporting_citations":[{"why":"defines the diffusion-classifier prompt-optimization baseline and the unlearning-evaluation scenarios that ZIUM extends and compares against.","marker":"[47]"},{"why":"supplies the image-captioning architecture that ZIUM turns into its optimizable visual-text alignment module.","marker":"[21]"},{"why":"establishes the diffusion-model-as-classifier principle that the attack's optimization loss is built on.","marker":"[18]"},{"why":"provides the concept-erasure unlearning formulation and one of the target models evaluated across all concept scenarios.","marker":"[11]"},{"why":"provides a safety-guided unlearning target model and the prompt dataset used for violence and illegal-activity evaluations.","marker":"[36]"},{"why":"provides an attention-based unlearning target model used in the attack evaluations.","marker":"[45]"},{"why":"provides an adversarially trained unlearning target used to test whether the attack still succeeds against stronger erasure.","marker":"[46]"},{"why":"supplies the inappropriate-content classifier used to score violence and illegal-activity attack success.","marker":"[35]"},{"why":"supplies the nudity-detection classifier used to score nudity attack success.","marker":"[1]"}],"fun_headline_variants":["Zero-shot attack reuses optimization to break unlearned models","Intent-aware adversarial prompts beat unlearned models with no retuning","ZIUM: attack unlearned models with customizable zero-shot prompts","Unlearned models vulnerable to reusable zero-shot adversarial attacks","After one concept fit, zero-shot prompts crack unlearned models"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The zero-shot phase assumes that the captioning-and-projection module optimized on one image of a removed concept still produces a usable text embedding for other images of that concept it has never seen; the paper reports high average success but does not analyze when this transfer breaks.","fun_headline_variants_meta":{"raw":{"variants":["Zero-shot attack reuses optimization to break unlearned models","Intent-aware adversarial prompts beat unlearned models with no retuning","ZIUM: attack unlearned models with customizable zero-shot prompts","Unlearned models vulnerable to reusable zero-shot adversarial attacks","After one concept fit, zero-shot prompts crack unlearned models"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000892,"raw_usage":{"total_tokens":3849,"prompt_tokens":949,"completion_tokens":2900,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":565,"completion_tokens_details":{"reasoning_tokens":2812}},"tokens_in":565,"tokens_out":2900,"duration_ms":24875,"temperature":1.0,"reasoning_tokens":2812,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T12:08:59.332932+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the initial per-concept attack on a single target image, freeze the resulting module, and evaluate it on held-out target images drawn from a deliberately different visual distribution (for example, heavily compressed images, artwork, or synthetic avatars). If the zero-shot attack success rate on that held-out set drops to the no-attack level while remaining high on near-distribution images, the zero-shot claim is conditional on visual similarity rather than general.","supporting_citations":[{"cited_title":"Holding a sword,","cited_arxiv_id":null,"evidence_quote":"defines the diffusion-classifier prompt-optimization baseline and the unlearning-evaluation scenarios that ZIUM extends and compares against."},{"cited_title":"Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models","cited_arxiv_id":null,"evidence_quote":"supplies the image-captioning architecture that ZIUM turns into its optimizable visual-text alignment module."},{"cited_title":"Your diffusion model is secretly a zero-shot classifier","cited_arxiv_id":null,"evidence_quote":"establishes the diffusion-model-as-classifier principle that the attack's optimization loss is built on."},{"cited_title":"Erasing concepts from diffusion models","cited_arxiv_id":null,"evidence_quote":"provides the concept-erasure unlearning formulation and one of the target models evaluated across all concept scenarios."},{"cited_title":"Safe latent diffusion: Mitigating inappro- priate degeneration in diffusion models","cited_arxiv_id":null,"evidence_quote":"provides a safety-guided unlearning target model and the prompt dataset used for violence and illegal-activity evaluations."},{"cited_title":"Forget-me-not: Learning to forget in text-to-image diffusion models","cited_arxiv_id":null,"evidence_quote":"provides an attention-based unlearning target model used in the attack evaluations."},{"cited_title":"Defensive unlearning with adversarial training for robust concept erasure in diffusion models.Advances in neu- ral information processing systems, 37:36748–36776, 2024","cited_arxiv_id":null,"evidence_quote":"provides an adversarially trained unlearning target used to test whether the attack still succeeds against stronger erasure."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"supplies the inappropriate-content classifier used to score violence and illegal-activity attack success."},{"cited_title":"Nudenet: Neural nets for nudity classification, detection and selective censoring","cited_arxiv_id":null,"evidence_quote":"supplies the nudity-detection classifier used to score nudity attack success."}],"review_version":1}