Stress Testing Concept Erasure with Large Language Model Agents

Concept erasure aims to remove specific semantic concepts from generative models (like text-to-image models) to satisfy safety and regulatory requirements. However, verifying whether a model has truly 'forgotten' a concept is difficult. Traditional evaluation methods often rely on static, pre-defined prompt sets that fail to capture the full range of potential model vulnerabilities. This paper asks: can we automate and improve the evaluation of concept erasure by using an adaptive, agent-based stress-testing framework?

The authors propose Stress Testing Agents for Concept Erasure (STACE), a multi-agent system that treats evaluation as an iterative hypothesis-search problem. STACE operates through a loop of five steps: task verification, hypothesis generation (via a debate between specialized agents), code synthesis, evaluation, and trace summarization.

Key to STACE is its grounding in external knowledge. Instead of relying solely on an LLM's internal intuition, the system uses a 'Literature Library'—a collection of structured summaries (PaperCards) derived from prior research. This allows the agents to propose testing strategies that are technically informed and systematically refined over multiple iterations. The framework also includes specific metrics, such as the Successful Identification Rate (SIR) and Earliest Identification Iteration (EII), to quantify how effectively and efficiently the agents uncover model failures.

Experiments across ten erasure tasks—covering objects, styles, intellectual property, and explicit content—demonstrate that STACE consistently outperforms five LLM-based evaluation baselines. It identified 4.3% more failure cases than the strongest baseline. The authors also show that STACE is robust across different text-to-image models and various erasure techniques. Furthermore, the framework is generalizable; by making minor adjustments to the prompts and literature library, the authors successfully adapted STACE to the domain of LLM jailbreaking, suggesting its utility for broader automated safety evaluation.