DriftScope: Measuring The Hidden Effects of Diffusion Model Adaptation¶

Conference: ECCV 2026
arXiv: 2607.00183
Code: None (Project page https://hyping111.github.io/DriftScope/)
Area: Diffusion Models / Model Diagnostics
Keywords: Diffusion Model Adaptation, Concept Drift, Cross-Attention Divergence, Model Differencing, Zero-Shot Classification

TL;DR¶

This paper demonstrates that text-to-image diffusion models undergoing adaptation (both concept customization and concept erasing) systematically damage other semantically unrelated concepts (with zero-shot classification accuracy of the worst-performing category dropping by up to 18.9 percentage points), while aggregate metrics such as FID/KID are structurally blind to this degradation. The authors propose DriftScope, a soft-prompt-optimization-based token-level concept drift diagnostic tool that ranks the most severely affected tokens by maximizing the divergence of cross-attention maps between two checkpoints.

Background & Motivation¶

Background: Adaptation of text-to-image diffusion models (e.g., Stable Diffusion) is a common operation in practical deployment, primarily falling into two categories: concept customization (e.g., DreamBooth, Custom Diffusion, which teach the model to generate a new concept) and concept erasing (e.g., EraseDiff, MACE, SPM, which remove unsafe content from the model). Conventional evaluations of these adaptation operations focus almost exclusively on their intended outcomes: Can the customized model successfully generate the new concept? Does the erasing model effectively block harmful content?

Limitations of Prior Work & Key Challenge: Standard evaluation metrics (FID, KID, and prompt-specific evaluations) focus solely on aggregate quality and target task performance, leaving them blind to fine-grained distribution shifts. By the time the adaptation-induced damage is severe enough to affect FID and KID, the model is already virtually unusable. Conversely, while the model functions normally according to stable FID and KID metrics, specific categories have silently suffered a drop in zero-shot accuracy of up to 18.9 percentage points. The core issue lies in granularity: aggregate metrics are structurally incapable of detecting degradation concentrated on specific concepts. Crucially, this phenomenon occurs at both ends of the adaptation spectrum (adding concepts and removing concepts), implying that it is a systematic consequence of weight-level modifications rather than an artifact of any specific method.

Key Insight & Core Idea: This paper first utilizes Sparse Autoencoder (SAE) analysis to prove the existence of concept-level drift, and then employs zero-shot classification to verify that this drift indeed manifests as a loss of semantic capability (i.e., concepts are truly degraded rather than merely shifted in distribution). Consequently, the authors propose DriftScope: given any prompt and two checkpoints (the base model and the adapted model), it identifies the tokens where the two models diverge the most by maximizing differentiable cross-attention divergence, returning a ranked drift report. The core idea is to employ differentiable prompt optimization as a measuring instrument to pinpoint where the two models disagree down to specific words, enabling interpretable, concept-level auditing.

Method¶

Overall Architecture¶

The proposed method consists of two parts: (1) Establishment Phase—utilizing SAE analysis and zero-shot classification to build the factual foundation of "adaptation-induced hidden concept drift"; (2) Diagnostic Phase—employing DriftScope as a practical tool to output token-level drift reports.

In the establishment phase, SAE analysis leverages a Sparse Autoencoder trained on DINOv2 features to decompose image embeddings into approximately interpretable concept activations, calculating a drift score \(\omega(k)\) across concepts for paired images generated by the base and adapted models. Zero-shot classification then uses the Gaussian Diffusion Classifier (GDC) to evaluate accuracy changes before and after adaptation on three standard benchmarks (CIFAR-10, Flowers-102, Food-101), exposing a damage pattern characterized by "stable averages but severe worst-class degradation."

The diagnostic phase is DriftScope, whose pipeline is shown below:

%%{init: {'flowchart': {'rankSpacing': 24, 'nodeSpacing': 28, 'padding': 6, 'wrappingWidth': 400}}}%%
flowchart TD
    A["User Input:<br/>prompt + two checkpoints"] --> B["Parameterize prompt as<br/>learnable soft prefix + fixed text + mask"]
    B --> C["Gumbel-Softmax discretization<br/>+ Token translator cross-vocab mapping"]
    C --> D["Parallel forward pass through base model ℳ_b<br/>and adapted model ℳ_m"]
    D --> E["Calculate L₁ difference of cross-attention maps<br/>averaged over multiple noise seeds + layers"]
    E --> F["Backpropagate to update soft prompt<br/>(both checkpoints frozen)"]
    F --> G["Decode mask tokens upon convergence<br/>and rank by drift score Δ"]
    G --> H["Output:<br/>high-drift token blacklist"]

Key Designs¶

1. SAE Concept-Level Drift Analysis: Attributing Distribution Shifts to Specific Concepts Using Sparse Autoencoders

SAE analysis was originally introduced by Bohacek et al. to compare generating blind spots between synthesized images and training data. This work adapts it to compare the generative distributions of two sets of weights under the same architecture. Specifically, 10,000 prompts are sampled from DiffusionDB, and paired images are generated on the base model \(\mathcal{M}\) and the adapted model \(\mathcal{M}'\) using the same prompts and noise seeds. For each concept \(k\), the drift score of SAE activations is calculated as:

\[\omega(k)=\sigma\left(\mathbb{E}_{x'\sim\mathcal{M}'}[\varepsilon_k(x')]-\mathbb{E}_{x\sim\mathcal{M}}[\varepsilon_k(x)]\right),\]

where \(\sigma\) is the sigmoid function, and \(\omega(k)=0.5\) indicates the two distributions are perfectly aligned. Baseline experiments (with the same model but different random seeds) show that \(\omega(k)\) is strictly concentrated around 0.5, confirming that random variance cannot explain the heavy-tailed distribution observed later (where a large number of concepts deviate from 0.5 toward either 0 or 1). While this analysis reveals which concepts have drifted, it cannot distinguish between a mere "distributional shift" and "damaged semantic capability"—hence, zero-shot classification is required to validate the semantic consequences of drift.

2. Zero-Shot Classification Validation: Exposing Aggregate Metric Blind Spots via GDC

GDC generates 240 images per class and aggregates them into CLIP image embedding prototypes; test images are then assigned to the nearest prototype based on cosine similarity. Classification accuracy relies entirely on the semantic coverage of the generative model—if adaptation erodes a certain concept, the corresponding prototype degrades, leading to a drop in the accuracy of that class. The key metric is the gap between the average change and the worst-class change: a minor decrease in the average coupled with a massive drop in a specific class serves as direct evidence of blind spots in aggregate metrics.

The experiments reveal three stages of damage: ① Catastrophic (EraseDiff), where FID/KID skyrocket, accuracy collapses across the board with a worst-class drop of over 90%—at this stage, aggregate metrics can detect the issue, but the model is already unusable; ② Hidden (SPM), where FID is merely 3.64 and KID is only \(2\times10^{-5}\), yet the worst-class accuracy on CIFAR-10 drops by 18.9 percentage points—the model passes aggregate checks but silently loses semantic coverage; ③ Most Subtle (DreamBooth), where FID and average accuracy remain almost unchanged, but the standard deviation is extremely large (e.g., on Flowers-102, the mean drops by only 2.88 while the standard deviation is 12.21), showing that a few classes are severely damaged while most remain unaffected.

3. DriftScope Differentiable Prompt Optimization: Pinpointing Divergence to the Token Level

The core idea of DriftScope is to treat prompt construction as a fill-mask task, employing Gumbel-Softmax relaxation to enable differentiable optimization over discrete tokens. The prompt is parameterized as \(p_\theta=[\mathbf{s}_\theta,\mathbf{t},\mathbf{m}]\), where \(\mathbf{s}_\theta\) is a learnable soft prefix, \(\mathbf{t}\) is fixed text, and \(\mathbf{m}\) represents the mask positions to be optimized. A fixed binary mapping matrix \(\mathbf{M}\in\{0,1\}^{V\times W}\) maps one-hot tokens from the MLM vocabulary to the target encoder vocabulary, establishing compatibility across different diffusion architectures (CLIP/T5).

The optimization objective is to minimize the L1 norm of the cross-attention map difference between the two models under the same prompt and noise seed (which yields a sharper localization effect than L2):

\[D(p)=\frac{1}{S}\sum_{s=1}^{S}\sum_{\ell\in\mathcal{L}}\left\|A^{(\ell)}(\mathcal{M}_b,p,z_s)-A^{(\ell)}(\mathcal{M}_m,p,z_s)\right\|_1.\]

Both checkpoints are frozen throughout, and gradients flow only through the soft prompt parameters. The optimization utilizes only the first 4 steps of the denoising trajectory (since early steps control high-level semantic structure and are most sensitive to concept drift). Each optimization run yields a candidate token with its associated drift score \(\Delta\). Running the process with multiple initializations allows the aggregation of the most frequent high-drift tokens to generate a blacklist.

4. Word-Level Drift Attribution: Full Prompt Context Rather Than Single Token Slices

Contrary to the intuitive approach of extracting attention slices only for the corresponding token, DriftScope computes the drift score based on the cross-attention maps of the full prompt. This captures the differences between how the two models process the entire scene (including object relations and context), rather than focusing on the isolated appearance of a single concept. This design rules out "spurious differences in single-token attention maps caused by prompt rearrangement" and reflects systematic representational changes. By inverting the objective (minimizing instead of maximizing \(\Delta\)), stable tokens can also be identified, providing contrastive validation.

A Complete Example: Diagnostic Drift in SPM Erasing Nudity¶

A user provides the prompt template "A photo of a [MASK]," along with the SD1.4 base model and the adapted model after SPM erases nudity. DriftScope runs 100 optimization trials (with different initialization seeds) on this template, obtaining the discrete token that maximizes cross-attention divergence in each run. After aggregation, "body," "goddess," "woman," "baby," and "sheet" emerge as the most frequent tokens—where concepts highly related to nudity, such as "woman," "body," and "goddess," are unexpectedly affected. Pairwise images generated using these high-drift tokens yield a CLIP-i of 0.88 and an LPIPS of 0.33. In contrast, low-drift tokens (e.g., "battle," "boat," "car") achieve a CLIP-i of 0.96 and an LPIPS of 0.14. This significant margin verifies that DriftScope effectively distinguishes between stable and damaged concepts.

Loss & Training¶

DriftScope undergoes no "training" in the traditional sense; its optimization process solely updates the parameters of the soft prompt \(\mathbf{s}_\theta\). Constraints and strategies include: utilizing Gumbel-Softmax temperature annealing for differentiable optimization of discrete tokens; batching multiple fixed noise seeds (\(S\) seeds) for generalization; and restricting the denoising trajectory to the first 4 steps to reduce memory and computational overhead (since early steps control high-level semantic structure and are sufficient to produce reliable drift signals). Both checkpoints remain frozen throughout, with no additional training objectives.

Key Experimental Results¶

Main Results: Zero-Shot Classification Evidence of Hidden Damage in Adapted Models¶

Paradigm	Method	Model	FID↓	KID↓	CIFAR-10 Worst/Mean	Flowers-102 Worst/Mean	Food-101 Worst/Mean
Erasing	AC	SD1.4	10.250	0.002	−21.5/−2.05	−87.3/−5.81	−29.5/−2.19
Erasing	EraseDiff	SD1.4	321.621	0.377	−91.9/−23.24	−98.1/−23.60	−87.3/−5.68
Erasing	MACE	SD1.4	60.812	0.033	−39.8/−5.93	−98.1/−19.77	−49.1/−11.65
Erasing	SPM	SD1.4	3.643	0.00002	−18.9/−3.91	−14.6/−0.13	−5.0/−0.19
Customization	DreamBooth	SD1.5	6.86±2.18	0.002±0.001	0.96±7.95	−2.88±12.21	0.08±11.86
Customization	DreamBooth	SD2.1	6.68±3.66	0.003±0.003	−2.22±5.73	−0.74±10.91	−0.91±12.45
Customization	DreamBooth	SD3.5	8.45±2.33	0.003±0.001	0.84±8.88	−0.21±10.72	−1.11±9.36

Erasing methods: lower FID/KID values indicate better performance; Customization methods: DreamBooth reports mean ± standard deviation (across 10 fine-tuned concepts). The SPM row clearly illustrates the hidden damage pattern where "FID/KID are almost perfect, but the worst-class accuracy on CIFAR-10 drops by 18.9 percentage points." The standard deviation in the DreamBooth rows reveals disparate damage masked by the average—mean accuracy on Flowers-102 drops by only 2.88, but the standard deviation is 12.21.

Diagnostic Separation of High-Drift vs. Low-Drift Tokens by DriftScope¶

Method	Model	Condition	CLIP-i↑	MS-SWD↓	LPIPS↓	Q-Eval↑
SPM	SD1.4	High Drift	0.88±0.11	1.02	0.33±0.20	0.50±0.16
SPM	SD1.4	Low Drift	0.96±0.05	0.39	0.14±0.11	0.43±0.14
ESD	SD1.4	High Drift	0.72±0.13	1.84	0.57±0.15	0.41±0.17
ESD	SD1.4	Low Drift	0.79±0.11	1.74	0.52±0.13	0.41±0.12
Scissorhands	SD1.4	High Drift	0.56±0.09	4.15	0.82±0.08	0.12±0.07
Scissorhands	SD1.4	Low Drift	0.62±0.10	4.01	0.78±0.11	0.19±0.08
DreamBooth	SD1.5	High Drift	0.81±0.13	1.87	0.51±0.18	0.52±0.18
DreamBooth	SD1.5	Low Drift	0.85±0.10	1.41	0.44±0.16	0.56±0.16
DreamBooth	SD2.1	High Drift	0.81±0.10	1.81	0.54±0.14	0.39±0.15
DreamBooth	SD2.1	Low Drift	0.84±0.09	1.44	0.50±0.15	0.42±0.16
DreamBooth	SD3.5	High Drift	0.81±0.10	2.20	0.54±0.13	0.69±0.17
DreamBooth	SD3.5	Low Drift	0.81±0.10	2.11	0.53±0.13	0.71±0.16

The gap between high and low drift is most pronounced for SPM (with a CLIP-i difference of 0.08 and an LPIPS difference of 0.19), indicating that DriftScope is highly effective for its diagnosis. There is almost no gap between high and low drift for Scissorhands, and its Q-Eval is extremely low (0.12), confirming it as global model degradation rather than localized concept erosion; in this case, DriftScope's attribution should be interpreted with caution. For DreamBooth on SD2.1, the Q-Eval under high drift is only 0.39 (compared to 0.69 for SD3.5), suggesting that SD3.5 is more robust.

Key Findings¶

The most critical hidden damage originates from SPM: With an FID of only 3.64 and a KID of \(2\times10^{-5}\), it appears near-perfect, yet accuracy for a CIFAR-10 class drops drastically by 18.9 percentage points—a textbook demonstration of aggregate-metric blind spots. DriftScope achieves the largest diagnostic separation here, validating its maximum value in "minor yet highly concentrated damage" scenarios.
The damage from DreamBooth is disparate rather than uniform: The standard deviation of accuracy changes across classes (e.g., 12.21 on Flowers-102) is significantly larger than the mean change (-2.88), indicating that damage is concentrated in a few classes. SD3.5 is relatively the most robust (achieving a high-drift Q-Eval of 0.69, which is significantly higher than SD1.5's 0.52 and SD2.1's 0.39).
Drifted tokens are semantically tied to erasing/customization targets, but the collateral damage is unexpected: Erasing "nudity" accidentally damages "body," "goddess," and "woman"; erasing "garbage" damages "truck" and "bus"; erasing "tench" damages "book" and "calendar"; customizing for "dog" on SD3.5 damages "bible," "dragon," and "devil." This confirms that the damage is structured and target-related, rather than random, making the drift reports returned by DriftScope actionable for specific adaptation operations.
Scissorhands serves as a degradation baseline: Its Q-Eval under high-drift is only 0.12, and its CLIP-i is only 0.56, indicating global model degradation where concept-level attribution is no longer reliable.

Highlights & Insights¶

Using "Differentiable Prompt Optimization as a Measuring Instrument" Rather Than an Attack Method: Prior works (e.g., SAGE, Ring-A-Bell, DEXTER) employ differentiable prompt optimization to generate adversarial prompts to expose failure modes of a single model or bypass safety filters. DriftScope repurposes the same toolkit for comparison—asking "where do these two models disagree?" rather than "where does this model fail?". This shift in perspective is fundamental: it transitions the technology from an attack tool into a diagnostic instrument.
Dual-Layer Validation Design Combining SAE and Zero-Shot Classification: SAE analysis \(\omega(k)\) exposes distribution shifts at the concept level, while zero-shot classification verifies whether such shifts correspond to actual semantic degradation. The two layers are complementary: SAE identifies that "the concept has drifted," and GDC confirms that "the concept is damaged." Lacking either layer would leave the work vulnerable to criticisms such as "the distribution shift is inconsequential" or "the performance drop is observed but the source is unknown."
Full-Prompt Cross-Attention Maps Instead of Single-Token Slices: While isolating the attention map of each individual token seems intuitive, doing so discards contextual relationships (object relations, modifiers, and scene context). Calculating drift using cross-attention maps of the full prompt captures the difference in how the two models process the entire scene. Although this design choice prevents attribution from visually mapping to a single pixel region, it filters out substantial spurious correlations.
Cross-Architecture Compatibility via a Binary Mapping Matrix: Different SD versions leverage different text encoders (CLIP variants or T5). A binary mapping matrix translates tokens predicted by MLM to their closest equivalents in the target encoder's vocabulary based on embedding similarity, requiring no modifications to the optimization objective or architecture-specific code.
Bifurcated Validation of High and Low Drift: Inverting the objective identifies low-drift tokens, forming a natural control group—if high-drift tokens genuinely suffer damage, low-drift tokens should generate almost identical image pairs. The gap in SPM (CLIP-i 0.88 vs. 0.96, LPIPS 0.33 vs. 0.14) strongly confirms this self-consistency check.

Limitations & Future Work¶

High Computational Overhead: DriftScope is optimization-based rather than analytical, requiring multiple initialization searches and averaging across several noise seeds—e.g., 100 runs × 5 prompt templates per class = 500 optimization steps. Although limited to the first 4 denoising steps, it remains relatively expensive for scanning large-scale deployments. The authors mention that multiple initializations aim to mitigate the effects of degenerate noise realizations, but they do not provide a strategy for adaptively determining the optimal number of runs.
Failure in the Presence of Global Model Degradation: When adaptation leads to widespread model degradation (e.g., Scissorhands), cross-attention maps globally lose informativeness, and concept-level attribution collapses. This is inherently the boundary between individual concept drift and global degradation—DriftScope operates on the premise that "the model can still generate effectively, but certain concepts are broken." If this assumption does not hold, the tool becomes ineffective.
Limited Precision in Token Mapping: The binary mapping matrix maps one-hot tokens from the MLM vocabulary to the "closest" corresponding token in the target encoder vocabulary (based on cosine similarity of token embeddings or exact matches). However, exact concept alignment may not exist between different vocabularies (especially when the target encoder is T5 and the MLM is BERT), causing the optimized high-drift tokens to have no precise equivalent in the target vocabulary.
Detection Only, No Mitigation: DriftScope is purely diagnostic, meaning it only alerts users about which concepts are damaged without proposing strategies on how to avoid or repair the degradation. A natural extension would be to integrate the drift signal as a constraint into the adaptation training process itself, which is not explored in this work.

vs COMPCON (Dunlap et al.): COMPCON uses evolutionary search to discover visual attribute differences between two independently trained T2I models. However, it compares models with entirely different architectures, data, and training processes, making it impossible to attribute divergences to a specific cause. DriftScope compares two checkpoints sharing the same starting architecture and weights that diverge due to a single adaptation step, enabling precise attribution; furthermore, DriftScope is entirely self-contained (requiring no iterative querying of external VLMs/LLMs) and produces token-level results directly via gradient backpropagation.
vs SAGE / Ring-A-Bell / DEXTER: These works make use of differentiable or adversarial prompt optimization to probe the failure modes of a single model or bypass filters. DriftScope repurposes this paradigm but targeting a completely distinct objective—instead of finding weaknesses in a single model, it localizes the most divergent tokens between two models. This distinction of "comparison rather than attack" allows DriftScope to output a concept-level drift report rather than a suite of adversarial examples.
vs Crosscoders (Lindsey et al.): Crosscoders train cross-encoder SAEs to decompose shared and unique features of a base and fine-tuned LLM from residual stream activations. DriftScope shares a similar objective (comparing two checkpoints) but targets a different modality (T2I diffusion models) and representation depth (cross-attention maps instead of residual streams) without requiring deep internal model access (since attention maps are standard outputs), offering broader generalizability.
vs C-LoRA / FL2T: These studies address forgetting under sequential customization setups, assuming that "forgetting is a known issue to be mitigated." DriftScope addresses a more foundational, upstream question—during a single adaptation, it does not prevent forgetting but rather exposes it, establishing concept-level auditing as a prerequisite for any subsequent mitigation strategy.

Rating¶

Novelty: ⭐⭐⭐⭐⭐ The diagnostic perspective of using differentiable prompt optimization for "comparison rather than attack" is highly original, and the dual-layer validation via SAE and GDC is a robust methodological innovation. It compliments prior model-differencing works like COMPCON and Crosscoders.
Experimental Thoroughness: ⭐⭐⭐⭐⭐ The experiments span 8 adaptation methods (4 erasing + 4 customization) × 3 architectures (SD1.4/1.5/2.1/3.5) × 3 zero-shot benchmarks, alongside 4 image-level divergence metrics (CLIP-I, MS-SWD, LPIPS, Q-Eval). Ablation studies validate generalizability to long prompts and domain-specific settings.
Writing Quality: ⭐⭐⭐⭐⭐ The motivational logic is highly cohesive (blind spots in aggregate metrics → SAE reveals drift → GDC validates semantic degradation → DriftScope pinpoints the tokens). The classification of three stages of damage (catastrophic, hidden, and subtle) provides a precise distillation of the studied phenomena.
Value: ⭐⭐⭐⭐⭐ The work directly challenges the validity boundaries of widely adopted aggregate metrics like FID/KID, providing a practical, prompt-by-prompt debugging strategy. It holds high utility for any production team modifying T2I models.