🤖 machine learning

FlowPure: Continuous Normalizing Flows for Adversarial Purification

The paper introduces FlowPure, a novel adversarial purification method based on Continuous Normalizing Flows and Conditional Flow Matching that outperforms state-of-the-art diffusion-based defenses on CIFAR datasets by effectively removing perturbations while preserving benign accuracy and enabling near-perfect adversarial detection.

Original authors: Elias Collaert, Abel Rodríguez, Sander Joos, Lieven Desmet, Vera Rimmer

Published 2026-03-31

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Elias Collaert, Abel Rodríguez, Sander Joos, Lieven Desmet, Vera Rimmer

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very smart security guard (a Machine Learning model) who checks IDs at a club. This guard is usually great at spotting fake IDs, but a clever forger (an adversarial attack) can add tiny, almost invisible smudges or scratches to a real ID card. To the naked eye, it looks normal, but the security guard gets tricked and lets the forger in.

For a long time, the best way to stop this was to train the guard to memorize every possible fake ID ever made. But this is exhausting, expensive, and sometimes makes the guard forget how to recognize real people (a drop in "benign accuracy").

Enter FlowPure, a new method proposed by researchers that acts like a magic cleaning station before the ID reaches the guard.

The Old Way: The "Noise Machine"

Previously, the best cleaning stations worked like a noise machine.

They would take the scratched ID and spray it with a heavy fog (Gaussian noise) to wash away the scratches.
Then, they would use a complex AI to try to "denoise" the image, hoping to reconstruct the original, clean ID.

The Problem: This process is a bit like trying to un-mix a smoothie. You add noise to wash away the bad stuff, but you also wash away some of the good stuff (the details of the face). It's also a bit rigid; the machine just sprays random fog, hoping it works for every type of scratch.

The New Way: FlowPure (The "Flowing River")

The researchers behind FlowPure realized they didn't need to spray random fog. Instead, they built a smart, flowing river that knows exactly how to guide a dirty ID back to a clean one.

Here is how it works, using simple metaphors:

1. The Map vs. The Fog

Instead of spraying random noise, FlowPure learns a direct map. Imagine you have a map that shows exactly how to walk from a "dirty room" (adversarial example) to a "clean room" (real image).

The Old Way: "I'm going to throw a bunch of water at this mess and hope it cleans up."
FlowPure: "I know the exact path. I will gently push this object along a specific river current until it lands perfectly in the clean room."

2. Two Types of Rivers

The paper introduces two versions of this river, depending on what you know about the enemy:

The "Sniper" River (Deterministic Variant):
If you know exactly what kind of forger you are fighting (e.g., they always use a specific type of scratch), FlowPure learns a super-specific path to fix that exact type of damage.
- Analogy: It's like a tailor who knows exactly how to stitch up a specific tear in a specific fabric. It works perfectly for that tear and doesn't damage the rest of the shirt.
- Result: It fixes the attack perfectly without ruining the original image.
The "Storm" River (Stochastic Variant):
What if you don't know what kind of attack is coming? Maybe the forger is unpredictable. FlowPure adds a little bit of "controlled chaos" (random noise) into the river while it flows.
- Analogy: Imagine the river has some rapids. If a forger tries to predict the path to trick the system, the rapids (random noise) throw them off balance. It makes the defense harder to hack, even if the attacker knows exactly how the river works.

3. The "Speedometer" Trick (Detection)

One of the coolest features of FlowPure is that it can also act as a lie detector.

When a clean ID goes through the river, it flows smoothly and quickly.
When a fake (adversarial) ID goes through, it hits a "speed bump." The system measures how fast the object is moving at the start. If it's moving too fast or erratically, the system knows, "Hey, this isn't a normal ID!" and flags it immediately.
Result: It can spot fake IDs with near-perfect accuracy, even before trying to clean them.

Why is this a Big Deal?

No Memory Loss: Unlike the old methods that sometimes made the security guard forget what real people look like, FlowPure keeps the "benign accuracy" high. The guard still recognizes real people perfectly.
Smarter Cleaning: It doesn't just guess; it learns the physics of how to move from "bad" to "good."
Harder to Hack: Even when attackers know the defense exists and try to outsmart it (the "white-box" scenario), FlowPure's "Storm River" version holds up better than the old fog machines.

The Bottom Line

FlowPure is like upgrading from a messy firehose (old diffusion models) to a precision-guided cleaning drone. It knows exactly how to wash away the invisible scratches that fool AI, keeps the original image pristine, and can even shout "Stop!" if it senses a fake ID is trying to sneak in. It's a smarter, more efficient way to keep AI systems safe.

1. Problem Statement

Deep neural networks are highly vulnerable to adversarial attacks, where small, crafted perturbations to input data cause incorrect model predictions. While Adversarial Training (AT) is a common defense, it often degrades performance on clean (benign) data and requires retraining the classifier.

Adversarial Purification (AP) has emerged as an alternative strategy, aiming to remove perturbations during inference without modifying the victim classifier. Current state-of-the-art AP methods rely on Diffusion Models. These models typically:

Inject Gaussian noise into an adversarial sample (forward process) to dilute the perturbation.
Use a learned reverse process to denoise the sample back to the data manifold.

Limitations of Current Methods:

Fixed Noise Processes: Diffusion models rely on a stochastic forward process that adds noise indiscriminately, which can disrupt semantic information and reduce benign accuracy.
Gradient Obfuscation: In white-box settings, diffusion-based defenses often suffer from gradient obfuscation, leading to overestimated robustness against adaptive attacks (e.g., DiffHammer).
Lack of Attack Specificity: Most methods do not explicitly leverage knowledge of the specific attack distribution during training, limiting their ability to learn targeted mappings.

2. Methodology: FlowPure

The authors propose FlowPure, a novel purification framework based on Continuous Normalizing Flows (CNFs) trained via Conditional Flow Matching (CFM). Unlike diffusion models that learn a stochastic denoising process, FlowPure learns a deterministic (or controlled stochastic) continuous transformation between distributions.

Core Concepts

Flow Matching (FM): Instead of simulating a stochastic differential equation (SDE), FM trains a model to predict a velocity field $v_\theta(x, t)$ that transports samples from a source distribution to a target distribution along a defined path.
Conditional Flow Matching (CFM): The model is trained on pairs of samples $(x_0, x_1)$ , where $x_0$ is the source (adversarial or noisy) and $x_1$ is the target (clean). The objective minimizes the difference between the predicted velocity and the true vector field $(x_1 - x_0)$ along a linear interpolation path (Optimal Transport path).

Two Variants of FlowPure

The paper introduces two distinct variants to address different threat models:

Deterministic FlowPure (Attack-Aware):
- Training: Trained on specific pairs of adversarial examples (e.g., PGD or CW attacks) and their clean counterparts. The model learns a direct mapping $x_{adv} \to x_{clean}$ .
- Inference: Solves the Ordinary Differential Equation (ODE) deterministically from $t=0$ to $t=1$ .
- Advantage: Can leverage specific attack knowledge to achieve near-perfect purification for known threats without degrading benign accuracy.
Stochastic FlowPure (Attack-Agnostic):
- Training: Trained as a standard generative CNF mapping Gaussian noise to the clean data distribution (similar to DiffPure but using CNFs).
- Inference: Uses a novel stochastic inference procedure. Instead of a pure ODE integration, the process involves:
  1. Backward integration to push the adversarial input toward the Gaussian source.
  2. Intermediate Noise Injection: At intermediate timesteps, noise is re-injected into the sample based on a time-dependent schedule ( $\eta(t)$ ).
  3. Forward integration to reconstruct the clean sample.
- Advantage: The injected noise disrupts precise adversarial gradients, making the defense more robust against adaptive white-box attacks (like DiffHammer) compared to deterministic flows.

Adversarial Detection

FlowPure can also function as an adversarial detector. The intuition is that adversarial examples, residing outside the data manifold, exhibit a significantly higher initial velocity magnitude ( $||v_\theta(0, x)||$ ) compared to clean samples. A threshold on this velocity score allows for high-accuracy detection.

3. Key Contributions

First Application of CNFs to Purification: FlowPure is the first method to apply Continuous Normalizing Flows to adversarial purification, moving away from the stochastic diffusion paradigm.
Dual-Variant Framework:
- A deterministic variant that learns direct mappings for known attacks, preserving benign accuracy.
- A stochastic variant that introduces noise during inference to counter adaptive attacks, outperforming diffusion baselines in worst-case scenarios.
Superior Performance in Preprocessor-Blind Settings: In scenarios where the attacker does not know the defense (black-box/preprocessor-blind), FlowPure achieves state-of-the-art robustness while fully preserving (or slightly improving) benign accuracy, a common failure point for diffusion-based methods.
Effective Adversarial Detection: The method achieves near-perfect detection accuracy (AUC $\approx$ 1.0) against PGD attacks, outperforming existing detection baselines like BEYOND.

4. Experimental Results

Experiments were conducted on CIFAR-10 and CIFAR-100 using a WideResNet-28-10 classifier.

Preprocessor-Blind Scenarios (Attacker unaware of defense)

Benign Accuracy: Deterministic FlowPure variants maintained or slightly improved standard accuracy (e.g., 96.00% on CIFAR-10 vs. 89.99% for DiffPure), whereas diffusion baselines often suffered significant drops.
Robust Accuracy: FlowPure variants significantly outperformed DiffPure, GDMP, LM, and ADBM against PGD and CW attacks.
- Example (CIFAR-10, PGD): FlowPure $_{PGD}$ achieved 92.23% robust accuracy vs. DiffPure's 73.69%.
Transferability: While deterministic variants were tailored to specific attacks, they showed reasonable transferability to similar attack types. The Gaussian variant offered broader robustness across different norms ( $L_\infty$ and $L_2$ ).

Fully Adaptive White-Box Scenarios (Attacker knows defense)

Challenge: All purification methods, including FlowPure, suffered significant performance drops under DiffHammer (the current SOTA adaptive attack), confirming the difficulty of defending against full gradient access.
Comparison: Despite the drop, the Stochastic (Gaussian) FlowPure variant outperformed all diffusion-based baselines.
- Example (CIFAR-10, DiffHammer): FlowPure $_{Gauss}$ achieved 43.12% average robust accuracy vs. DiffPure's 39.74%.
Gradient Masking: The gap between BPDA (approximate gradients) and DiffHammer (exact gradients) was smaller for FlowPure, suggesting less reliance on gradient obfuscation compared to diffusion models.

Detection Performance

FlowPure detected PGD attacks with near-perfect AUC (0.99-1.0) on both datasets, significantly outperforming the BEYOND detector, especially at low False Positive Rates (FPR).

5. Significance and Conclusion

Paradigm Shift: FlowPure demonstrates that Flow Matching is a viable and often superior alternative to Diffusion Models for adversarial purification. It allows for direct, deterministic mappings that preserve semantic content better than noise-injection methods.
Practical Deployment: The deterministic variant offers a highly practical defense for real-world scenarios where attackers are "preprocessor-blind" (e.g., open-weight models), providing strong robustness without sacrificing clean data performance.
Theoretical Insight: The results highlight that while no current purification method is robust against fully adaptive white-box attacks with full gradient access, stochastic variants of flow-based methods offer a more resilient baseline than their diffusion counterparts.
Dual Utility: The ability to serve as both a purifier and a detector adds significant value to the security pipeline.

In summary, FlowPure advances the state of the art by leveraging the efficiency and flexibility of Continuous Normalizing Flows to create defenses that are more robust, preserve benign accuracy, and offer dual functionality in detection.