Diffusion-consistent visual probing
TINA+ bypasses the text pathway and searches for diffusion-consistent visual trajectories, testing whether erased models still retain generative knowledge of the target concept.
Harbin Institute of Technology (Shenzhen) · City University of Hong Kong · National University of Singapore · Pengcheng Laboratory · Shenzhen Loop Area Institute
Core question
The prevailing test
Existing erasure methods and adversarial probes mainly operate through textual conditions. A failed text attack therefore shows that the text-to-image route is blocked, but does not establish that the model has forgotten how the concept looks.
Our visual test
TINA+ starts from a target image, searches for its seed latent under a null-text condition, and then asks the same erased model to regenerate the concept along a diffusion-consistent trajectory.
01
Although text-to-image diffusion models exhibit remarkable generative power, concept erasure techniques are essential for their safe deployment to prevent the creation of harmful content. Adversarial probes test whether erased concepts can still be recovered and have driven the development of stronger defenses. Yet both erasure and probe methods remain largely confined to a text-centric paradigm, testing whether the text-to-image mapping is severed while overlooking whether the corresponding visual knowledge remains.
We instead adopt a visual perspective and ask whether diffusion inversion can still find a generative trajectory that reconstructs visual instances of the erased concept. A natural starting point is standard inversion, where a text prompt facilitates faithful reconstruction. That textual condition is precisely what text-centric defenses suppress, and using it would prevent a purely visual assessment. Operating under a null-text condition removes this dependence, but amplifies the approximation errors of standard inversion and hinders faithful trajectory recovery.
We therefore introduce TINA+, a diffusion-consistent Text-free INversion Attack with an optimization-based inversion procedure that improves null-text inversion accuracy. Beyond accuracy, we find that unconstrained inversion may discover spurious trajectories and can even allow a randomly initialized diffusion model to reconstruct the target concept. These trajectories are inconsistent with the diffusion process and may falsely indicate the presence of residual visual knowledge.
TINA+ therefore introduces Diffusion-Consistent Trajectory Regularization. By penalizing trajectories that fall far below the expected marginal energy evolution of diffusion, TINA+ avoids spurious inversion paths while preserving its ability to recover erased concepts through diffusion-consistent trajectories.
Experiments across twelve erasure methods, four concept-erasure tasks, and different model architectures demonstrate that TINA+ reliably probes residual visual knowledge through diffusion-consistent trajectories. The results provide stronger evidence that current methods often obscure concepts by severing text-image links rather than eliminating the underlying visual knowledge.
02
From a target image to a valid seed latent, then back through the same concept-erased model under a null-text condition.
Technical overview
Encode a representative target image and remove dependence on the erased prompt.
Optimize each latent for fixed-point consistency instead of accepting accumulated DDIM approximation errors.
Use forward marginal initialization and marginal energy regularization to suppress diffusion-inconsistent paths.
Generate from the discovered seed with the same erased model and test whether the concept reappears.
03
TINA+ remains effective in settings where attacks through textual conditions are substantially suppressed.
Quantitative results
Choose a task, then swipe or scroll horizontally to inspect the full table. Higher ASR is better.
Attack Success Rate (%) across eight nudity-erasure defenses.
| Attack | ESD | FMN | UCE | MACE | RECE | AdvUn. | SalUn | STEREO | AVG. |
|---|---|---|---|---|---|---|---|---|---|
| PEZ | 11.86 | 62.71 | 25.42 | 8.47 | 15.25 | 1.69 | 0.00 | 0.00 | 15.68 |
| MMA | 13.10 | 67.00 | 32.60 | 6.00 | 22.80 | 1.70 | 1.70 | 5.50 | 18.80 |
| RAB | 50.53 | 97.89 | 29.47 | 6.32 | 10.53 | 2.11 | 0.00 | 8.42 | 25.66 |
| P4D | 69.01 | 97.89 | 76.06 | 75.35 | 66.20 | 18.31 | 15.49 | 24.65 | 55.37 |
| UDA | 76.05 | 97.89 | 78.87 | 81.69 | 63.38 | 23.24 | 13.38 | 25.35 | 57.48 |
| TINA+ | 86.44 | 100.00 | 97.46 | 93.22 | 93.22 | 92.37 | 73.73 | 97.46 | 91.74 |
Attack Success Rate (%) on Van Gogh artistic-style erasure.
| Attack | ESD | FMN | AC | MACE | SPM | RECE | AdvUn. | STEREO | AVG. |
|---|---|---|---|---|---|---|---|---|---|
| PEZ | 2.0 | 0.0 | 0.0 | 0.0 | 5.0 | 0.0 | 0.0 | 0.0 | 0.9 |
| MMA | 0.0 | 2.0 | 6.0 | 0.0 | 14.0 | 14.0 | 0.0 | 0.0 | 4.5 |
| RAB | 6.0 | 6.0 | 14.0 | 4.0 | 48.0 | 20.0 | 0.0 | 0.0 | 12.3 |
| P4D | 30.0 | 54.0 | 68.0 | 42.0 | 78.0 | 62.0 | 0.0 | 0.0 | 41.8 |
| UDA | 32.0 | 56.0 | 77.0 | 56.0 | 88.0 | 64.0 | 2.0 | 0.0 | 46.9 |
| TINA+ | 60.0 | 70.0 | 72.0 | 72.0 | 74.0 | 72.0 | 68.0 | 46.0 | 66.8 |
Attack Success Rate (%) across four object concepts and eight erasure defenses.
| Attack | FMN | SPM | ESD | EraseDiff | SalUn | SH | AdvUn. | STEREO | AVG. |
|---|---|---|---|---|---|---|---|---|---|
| Church | |||||||||
| PEZ | 32.00 | 34.00 | 2.00 | 2.00 | 12.00 | 0.00 | 0.00 | 0.00 | 10.25 |
| MMA | 32.00 | 26.00 | 6.00 | 10.00 | 8.00 | 0.00 | 0.00 | 2.00 | 10.50 |
| RAB | 58.00 | 68.00 | 14.00 | 28.00 | 4.00 | 0.00 | 0.00 | 0.00 | 21.50 |
| P4D | 94.00 | 94.00 | 58.00 | 42.00 | 62.00 | 0.00 | 2.00 | 8.00 | 45.00 |
| UDA | 98.00 | 94.00 | 66.00 | 50.00 | 68.00 | 4.00 | 8.00 | 10.00 | 49.75 |
| TINA+ | 92.00 | 90.00 | 90.00 | 94.00 | 90.00 | 90.00 | 92.00 | 78.00 | 89.50 |
| Garbage Truck | |||||||||
| PEZ | 36.00 | 18.00 | 0.00 | 4.00 | 4.00 | 0.00 | 0.00 | 0.00 | 7.75 |
| MMA | 28.00 | 4.00 | 0.00 | 0.00 | 2.00 | 0.00 | 0.00 | 0.00 | 4.25 |
| RAB | 40.00 | 34.00 | 8.00 | 20.00 | 20.00 | 0.00 | 2.00 | 0.00 | 15.50 |
| P4D | 98.00 | 76.00 | 24.00 | 44.00 | 38.00 | 8.00 | 4.00 | 2.00 | 36.75 |
| UDA | 100.00 | 80.00 | 32.00 | 46.00 | 36.00 | 6.00 | 8.00 | 6.00 | 39.25 |
| TINA+ | 90.00 | 86.00 | 74.00 | 76.00 | 78.00 | 84.00 | 80.00 | 66.00 | 79.25 |
| Parachute | |||||||||
| PEZ | 22.00 | 22.00 | 0.00 | 6.00 | 6.00 | 0.00 | 0.00 | 0.00 | 7.00 |
| MMA | 32.00 | 20.00 | 0.00 | 8.00 | 6.00 | 2.00 | 2.00 | 0.00 | 8.75 |
| RAB | 38.00 | 14.00 | 2.00 | 14.00 | 0.00 | 8.00 | 0.00 | 0.00 | 9.50 |
| P4D | 100.00 | 92.00 | 50.00 | 68.00 | 70.00 | 24.00 | 14.00 | 2.00 | 52.50 |
| UDA | 100.00 | 94.00 | 58.00 | 76.00 | 80.00 | 24.00 | 16.00 | 6.00 | 56.75 |
| TINA+ | 94.00 | 92.00 | 84.00 | 90.00 | 90.00 | 90.00 | 88.00 | 80.00 | 88.50 |
| Tench | |||||||||
| PEZ | 6.00 | 2.00 | 0.00 | 0.00 | 2.00 | 0.00 | 0.00 | 0.00 | 1.25 |
| MMA | 24.00 | 16.00 | 2.00 | 0.00 | 2.00 | 0.00 | 0.00 | 0.00 | 5.50 |
| RAB | 12.00 | 24.00 | 6.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 5.25 |
| P4D | 94.00 | 82.00 | 32.00 | 8.00 | 18.00 | 6.00 | 8.00 | 0.00 | 31.00 |
| UDA | 100.00 | 88.00 | 46.00 | 2.00 | 12.00 | 6.00 | 2.00 | 2.00 | 32.25 |
| TINA+ | 82.00 | 78.00 | 64.00 | 78.00 | 72.00 | 80.00 | 80.00 | 66.00 | 75.00 |
Attack Success Rate (%) for three celebrity identities under ESD and STEREO.
| Attack | Taylor Swift | Elon Musk | Adam Lambert |
|---|---|---|---|
| ESD | |||
| PEZ | 2.00 | 0.00 | 4.00 |
| MMA | 2.00 | 0.00 | 2.00 |
| RAB | 12.00 | 6.00 | 4.00 |
| P4D | 98.00 | 100.00 | 90.00 |
| UDA | 98.00 | 100.00 | 92.00 |
| TINA+ | 96.00 | 98.00 | 94.00 |
| STEREO | |||
| PEZ | 0.00 | 0.00 | 0.00 |
| MMA | 0.00 | 0.00 | 0.00 |
| RAB | 0.00 | 0.00 | 0.00 |
| P4D | 0.00 | 0.00 | 0.00 |
| UDA | 0.00 | 0.00 | 0.00 |
| TINA+ | 94.00 | 46.00 | 64.00 |
Qualitative results
04
A visually similar reconstruction is not sufficient. Even a random model can be inverted through an invalid trajectory.
Trajectory diagnostics
Forward Marginal Initialization provides an aligned starting point. The marginal energy constraint then prevents optimization from exploiting a severe energy collapse in the Random-UNet negative control.
Negative control
DDIM and unconstrained TINA can reproduce recognizable target characteristics from a model with no learned target knowledge. TINA+ suppresses these false positives during optimization instead of merely rejecting them afterward.
05
06
This entry will be updated when the paper is publicly released.
@misc{xiang2026tinaplus,
title = {TINA+: Probing Residual Visual Knowledge in Unlearned
Diffusion Models via Diffusion-Consistent Text-Free Inversion},
author = {Xiang, Qianlong and Zhang, Miao and Wang, Kun and Zhang, Haoyu
and Hou, Junhui and Nie, Liqiang},
year = {2026}
}