The Linear Geometry of Interpretable Tokens: Jailbreaking Attacks and Defenses for Unlearned Diffusion Models

The paper investigates how diffusion models, even after fine‑tuning to unlearn harmful concepts, still retain a linear residual of those concepts in token embeddings. It introduces SubAttack, a jailbreak method that extracts this residual by learning orthogonal attack tokens composed of interpretable textual elements, and SubDefense, a plug‑and‑play defense that projects out the same subspace to suppress the residual. Experiments show SubAttack outperforms prior attacks in power and transferability, while SubDefense offers stronger robustness and better preservation of safe generation quality.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv Computer Vision.

• rag
• diffusion
• fine-tuning
• safety