Official implementation of TRACER.
Diffusion models exhibit powerful generative capabilities. Despite these advances, their large-scale deployment has raised concerns about copyright infringement and harmful or biased content generation. Concept unlearning aims to suppress designated concepts while preserving other generative capabilities. Most existing methods achieve this by modifying pretrained model weights, demonstrating promising results in unlearning individual concepts or sets of concepts.
Existing attacks exploit vulnerabilities in unlearned models to regenerate erased content, but they typically assume prior knowledge of the specific concepts to recover. In practice, model providers may not disclose what they have removed. Even access to the original base model does not directly reveal which of its many concepts the provider chose to erase. For example, a provider may erase a small set of individuals' identities for privacy reasons. Although the base model may still generate depictions of these individuals, access to this capability alone does not tell an adversary who was selected for protection. Identifying the erased concepts therefore provides information beyond access to the original model: it reveals the provider's undisclosed targets and allows an adversary to focus subsequent attacks on the content the provider sought to suppress. This raises two critical but overlooked questions: without any prior knowledge of the erasure targets, can an adversary know which concepts have been erased from the model, and how many have been erased in total? To the best of our knowledge, no existing method systematically addresses this identification problem in unlearned diffusion models.
Potential approaches include adapting traditional membership inference attacks (MIAs) or comparing images generated by the original and unlearned models for each candidate. However, extending these approaches to reliable and efficient identification of unknown erasure targets presents challenges. First, unlearning can affect both target and non-target concepts. Changes in membership scores or generated content therefore cannot reliably distinguish directly targeted concepts from indirectly affected ones. Second, the number of erased concepts is unknown. Identifying the target set requires determining which candidates to select and when to stop, without target labels for calibration. Third, both approaches incur substantial computational costs even with a predefined candidate set. Without a narrowly specified set, the search may span a vocabulary containing tens of thousands of words, making repeated generation or MIA-based probing prohibitively expensive.
In this paper, we introduce a novel method, Tracing Concepts Erased by Unlearning (TRACER), for rapidly and accurately identifying erased concepts and estimates their number without any prior knowledge of the erasure targets. An intuitive but inconclusive approach is to compare the unlearned model weights with its original base model. However, these weight differences span distinct representation spaces, making it difficult to map them directly to erased concepts. To turn these differences into usable evidence, TRACER constructs Gram matrices from weight differences and uses a small set of probe words to identify compatible representation groups, then applies spectral reweighting to balance signals before aggregation, producing an erasure footprint for each group. These footprints provide the basis for identifying candidate concepts whose representations collectively explain the observed changes. To identify multiple erased concepts, we formulate identification as a subspace coverage problem, which measures how much of the erasure footprint a set of candidate concepts can collectively explain. Specifically, starting from an empty set, TRACER iteratively adds the candidate that best explains the remaining footprint energy, reducing redundant selections and directing the search toward other erased concepts. To estimate the number of erased concepts, we track candidate confidence throughout this coverage-based selection process. As the selected concepts account for the dominant footprint energy, a sharp decline in confidence indicates a cutoff in the selected sequence, allowing us to estimate the erased-set size without labeled calibration data.
Experiments on text-to-image and text-to-video backbones and diverse unlearning methods demonstrate TRACER identifies erased concepts and estimates their number in seconds, achieving 5300× speedup over MIA and brute-force search with substantially higher identification accuracy.
Python 3.10, PyTorch 2.6, CUDA 12.4+, one NVIDIA GPU (RTX A6000 in the paper).
conda create -n tracer python=3.10 -y && conda activate tracer
pip install -r requirements.txtBase models are downloaded from the HuggingFace Hub on first use.
One command, one checkpoint directory in, the recovered concepts and their count out:
python tracer/tracer.py \
--arch sd --model_id stable-diffusion-v1-5/stable-diffusion-v1-5 \
--ckpt_dir checkpoints/UCE/imagenet1k-K10 \
--vocab dataset/vocab/imagenet1k_1000.json[sd] 10 ckpts | 32 imprints | 1 group(s)
[sd] encoded 1000 candidates in 7.4s
uce-G10a-N10 n^=10 0.38s ['beaver', 'mobile home', 'fox squirrel', ...]
Pass --groups_csv to also score against ground truth; the attack itself never reads it.
Other backbones need nothing but --arch and --model_id:
python tracer/tracer.py --arch flux --model_id black-forest-labs/FLUX.1-schnell ...
python tracer/tracer.py --arch sd3 --model_id stabilityai/stable-diffusion-3-medium-diffusers ...
python tracer/tracer.py --arch cogvideox --model_id THUDM/CogVideoX-5b ...
python tracer/tracer.py --arch wan --model_id Wan-AI/Wan2.1-T2V-1.3B-Diffusers ...| Flag | |
|---|---|
--templates art |
artist vocabulary needs art phrasings; "a photo of a {}" is not neutral for a painter |
--internal |
the erasure touches no text-conditioned matrix (e.g. ESD on FLUX): group per attention module and read internal activations instead |
--phrase |
Appendix A.2 — construct multiword candidates instead of ranking the vocabulary |
--beta --gamma --rho --offset |
the self-calibration grid; the default is the paper's 24 settings |
--horizon |
search horizon J; bounds the size reading only, not recall at a known K |
--rho 1 / --gamma 0 / --beta 0 / --largest_drop_only |
ablation arms |
See tracer/run.sh for the full set of experiment commands.
# brute-force generation probing (Eq. 12) and the adapted MIA (Eq. 13)
python utils/baselines.py --attack bruteforce --phase score --ckpt "" --out results/bf/base.json ...
python utils/baselines.py --attack bruteforce --phase rank --score_dir results/bf \
--groups_csv dataset/groups/imagenet1k_K10.csv --tracer results/uce_k10.json ...--phase rank reports recall, the collateral diagnostic, and a comparison paired per checkpoint
against a TRACER result file. Both baselines are given every advantage — identical seeded latents,
base-model samples, and credit for the better of the two ranking directions.
Released .pt checkpoints can be normalised first with
utils/convert.py, which records the base model in the metadata.
dataset/groups/*.csv are group_id,N,concepts: one row per released checkpoint, listing the
concepts it jointly erased. dataset/vocab/*.json are candidate vocabularies.
imagenet1k_K10.csv, imagenet1k_ladder.csv |
the main benchmark and the K = 1,3,5,10,20 ladder, ten disjoint groups per rung |
artist_single.csv, artist_K3.csv, artist_K5.csv |
artistic styles |
imagenet1k_1000.json |
closed vocabulary — used against the baselines, whose cost caps the pool |
openset_73406.json |
open vocabulary — used for ablations, where that cap does not apply |
artists_1734.json |
artist names |
Numbers from different vocabularies are not comparable; every table must state the pool it used.
Checkpoints must be real joint erasures — summing K single-concept weight differences is a
constructive control, not a multi-concept result.
@misc{tracer2026,
title = {Your Unlearning Gives You Away: Identifying Erased Concepts in Diffusion Models},
author = {Anonymous},
note = {Under review},
year = {2026}
}We evaluate against the official implementations and released checkpoints of ESD, UCE, MACE, FMN, ConceptPrune, SPEED, ScaPre, STEREO, AdvUnlearn, EraseAnything, EraseFlow, VideoEraser and others, used without modification. The open vocabulary combines the ImageNet-1k class names with the GNU Aspell word list.
MIT, see LICENSE. Base models, unlearning implementations and evaluation datasets
carry their own licenses.