Beyond Prompt Attacks: Least-Action Auditing of Concept Erasure

Yifei Zhu

Concept erasure, or concept unlearning, in text-to-image diffusion models is usually audited with prompt attacks. A prompt attack tests whether one conditioning string still retrieves the erased concept. It does not measure the probability that the frozen generator still assigns to that concept. We introduce least-action auditing of this residual probability, and evaluate it on Stable Diffusion concept-erasure checkpoints. The least-action barrier is the minimum control cost of driving the frozen reverse process into a detector-defined concept event. This cost equals the path-space KL divergence of conditioning the model on the event, and therefore the event's negative log-probability. The estimate $ΔS_{\mathrm{rob}}$ uses a CLIP$\wedge$DINOv2 consensus terminal, with no retraining and no adversarial prompt. Across $18$ erased concept-mechanism pairs spanning object classes and NSFW nudity, $ΔS_{\mathrm{rob}}$ predicts deployment leakage counted on $1{,}500$ fresh samples per model by detectors excluded from the audit (pooled Spearman $ρ{=}{-}0.76$, $p{=}5{\times}10^{-4}$). Within every audited concept, the eraser with the higher barrier leaks less ($18/18$). On NSFW nudity the…