Erased but Not Forgotten: How Backdoors Compromise Concept Erasure

The expansion of text-to-image diffusion models has raised concerns about harmful outputs, from fabricated depictions of public figures to sexually explicit imagery. To mitigate such risks, prior work has proposed concept erasure methods that aim to sever unwanted concepts from the model via fine-tuning, yet it remains unclear whether these approaches truly remove all links to the harmful concept or merely conceal superficial connections. In this work, we reveal a critical vulnerability, the Erasure Evasion Backdoor (EEB): an adversary binds a backdoor trigger to a concept slated for removal, and this malicious link survives subsequent erasure. We show that both black-box and white-box adversaries can instantiate this threat. Across six state-of-the-art erasure methods, including robust ones that explicitly search for alternative representations of the target concept, EEB consistently exposes harmful content: up to 82% success against celebrity-identity unlearning, up to 94% for object erasure, and up to 16$\times$ amplification of explicit-content exposure. While EEB uncovers a blind spot in current erasure methods, it also provides a diagnostic tool for stress-testing future concept erasure techniques.

Text-to-image AI systems can generate harmful content, such as fake images of public figures or sexual images. One popular safety fix is “concept erasure,” which tries to remove a dangerous concept from the model so it can no longer be generated. Our work shows that this protection can fail in a hidden way. We study a new attack called an Erasure Evasion Backdoor. The idea is to secretly connect a harmless-looking trigger, such as an unusual word, to a harmful concept before the safety removal happens. After the model is “sanitized,” the obvious prompt may no longer work, but the hidden trigger can still bring the harmful content back. We test this idea in several attack settings and across different kinds of erased content, including celebrity identities, objects, and explicit material. We find that current erasure methods often remove the visible access path without removing the hidden one. This matters because our method can help researchers build stronger tests for future AI safety methods.