cd /news/machine-learning/erased-but-exploitable-black-box-emb… · home topics machine-learning article
[ARTICLE · art-14875] src=arxiv.org pub= topic=machine-learning verified=true sentiment=· neutral

Erased but Exploitable: Black-box Embedding-Aware Prompting Against Unlearned Text-to-Image Diffusion Models

Researchers have developed BEAP, a black-box adversarial prompting attack that exploits vulnerabilities in text-to-image diffusion models that have undergone machine unlearning. The attack uses a large language model to iteratively generate undetectable prompts that force the model to produce unlearned concepts, achieving over 60% higher attack success rates than prior methods. This work exposes a critical security gap in current unlearning approaches, as BEAP requires no access to model weights and evades existing safety filters.

read1 min publishedMay 27, 2026

arXiv:2605.26332v1 Announce Type: new Abstract: Machine unlearning aims to remove specific concepts from pretrained text-to-image diffusion models, yet several white- and black-box attacks have been introduced to make the model generate such unlearned concepts. These attacks, nevertheless, do not assume a realistic threat model, i.e. they either assume access to the model weights, or result in gibberish adversarial prompts that could be easily detected even through naive rule-based safeguarding. We aim to address this gap in this paper. We introduce BEAP, a black-box, embedding-aware adversarial prompting attack that leverages a large language model (LLM) to iteratively generate effective adversarial prompts and exploit such hidden vulnerabilities. BEAP performs an embedding-aware search in text space, combining multiple reward signals: unlearned concept presence, text-image alignment, and image quality, to refine generated prompts. Unlike previous attack methods, BEAP keeps its prompts undetectable to safety filters while producing high-quality images. Extensive experiments show that BEAP improves the Attack Success Rate (ASR) by more than 60% over prior methods, while requiring only an average of fifteen prompts per successful attack. Warning: This paper contains model outputs that may be offensive or upsetting in nature.

── more in #machine-learning 4 stories · sorted by recency
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
Live at https://your-agent.zahid.host
Get free account → Pricing
from €0/mo · no card required
LIVE [news/erased-but-exploitab…] indexed:0 read:1min 2026-05-27 ·