🤖 AI

FlowGuard: Flow Matching for Identity-Independent Detection of Data-Free Model Stealing Attacks on Energy System Intrusion Detection Systems

The paper proposes FlowGuard, an identity-independent defense mechanism for energy system intrusion detection systems that utilizes flow matching to detect data-free model stealing attacks by identifying synthetic queries as out-of-distribution based on their lower-dimensional manifold structure.

Original authors: Maxime Schwarzer, Laurin Holz, Tobias Huerten, Johannes Loevenich, Thies Moehlenhof, Roberto Rigolin F. Lopes, Veit Hagenmeyer

Published 2026-06-03

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Maxime Schwarzer, Laurin Holz, Tobias Huerten, Johannes Loevenich, Thies Moehlenhof, Roberto Rigolin F. Lopes, Veit Hagenmeyer

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: Stealing the "Brain" of a Security Guard

Imagine a highly sophisticated security guard (an AI system) protecting a power plant. This guard is very good at spotting intruders. However, a thief wants to steal the guard's "brain" (the AI model) so they can build a fake version of it.

Why? Because with the fake version, the thief can practice in secret. They can figure out exactly how to sneak past the real guard without getting caught. This is called a Model Stealing Attack.

The problem is that the thief doesn't need to be a genius or have the guard's original training manual. They can just ask the guard thousands of questions like, "Is this picture a cat or a dog?" and "Is this traffic pattern normal or an attack?" The thief uses a computer to generate these questions automatically.

The Old Ways of Catching Thieves (And Why They Failed)

The paper explains that previous security systems tried to catch these thieves in two ways, but both had big holes:

The "ID Badge" Method (PRADA): This system watched who was asking questions. If one person asked 1,000 questions in a row, it sounded suspicious.
- The Flaw: The thief can use a "Sybil Attack." They create 100 fake identities (like 100 different email addresses) and split the questions among them. Now, no single person looks suspicious, and the security system lets them all through. The paper shows this method drops to 0% effectiveness when the thief does this.
The "Confusing Answers" Method (Prediction Poisoning): This system tried to give the thief slightly wrong or confusing answers to mess up their fake model.
- The Flaw: Many real-world security guards only give a simple "Yes/No" answer (Hard Label). They don't give the detailed probability scores needed to make this trick work.

The New Solution: FlowGuard

The authors propose a new defense called FlowGuard. Instead of checking who is asking the question, FlowGuard checks what the question looks like.

The Analogy: The "Real vs. Fake" River

Imagine the legitimate network traffic (normal data) is a wide, deep, flowing river. The AI guard is trained to recognize everything that flows in this river.

Legitimate Queries: These are like smooth, natural stones picked up from the riverbed. They fit perfectly into the flow.
Thief's Queries: The thief uses a computer to generate questions from "noise" (random static). These are like plastic rocks made in a factory. Even if they look like stones, they don't have the same weight, texture, or history as the real river stones.

FlowGuard is a special sensor placed at the entrance of the river. It doesn't care who is holding the stone. It just measures the stone's "density" (how likely it is to be a real river stone).

If the stone is a real river stone (Legitimate), it fits the flow perfectly.
If the stone is a plastic factory rock (Thief's synthetic query), it feels "light" and out of place. The sensor detects this low "density" and blocks it immediately.

How It Works (The "Flow Matching" Magic)

The paper uses a mathematical tool called Flow Matching (specifically Continuous Normalizing Flows).

Think of this as a magical reverse-engineering machine:

The system takes a question and tries to "un-mix" it, tracing it backward to see where it came from.
Real questions trace back to a "normal" starting point (a standard Gaussian distribution).
The thief's fake questions, because they were made by a different process, get stuck or trace back to weird, unlikely places.
The system calculates a "Likelihood Score." If the score is too low (meaning the question is very unlikely to be real), it gets blocked.

The Results: Why FlowGuard Wins

The researchers tested this against two famous thief techniques (MAZE and DisGUIDE) in two scenarios:

Single Thief: One person asking all questions.
- Result: FlowGuard caught almost all of them (96–100% detection).
The "Sybil" Thief: 100 fake people splitting the questions.
- Result: The old "ID Badge" method (PRADA) failed completely (0% detection). FlowGuard still caught 96–100% of the thieves.

Why? Because FlowGuard doesn't care about the ID badge. It only cares that the question itself looks like a plastic factory rock. Even if 1,000 different people ask the question, if the question is fake, FlowGuard blocks it.

Summary of Limitations (What the Paper Actually Says)

The paper is honest about what it doesn't do yet:

It was tested on a standard image dataset (CIFAR-10), not yet on real power grid data (though the authors plan to do this).
It currently only catches thieves who generate questions from scratch (Data-Free attacks). It doesn't claim to stop thieves who have access to real data.
It is a "lower-tail" detector, meaning it blocks things that look too unlikely, but it relies on a specific threshold setting.

The Takeaway

FlowGuard is a security system that ignores the "who" and focuses entirely on the "what." By using advanced math to measure how "real" a question feels, it can stop thieves from stealing security models, even if those thieves try to hide by using hundreds of fake identities. It turns the thief's own synthetic (fake) data against them.

Technical Summary: FlowGuard

Problem Statement
Artificial Intelligence-based Intrusion Detection Systems (IDS) deployed in critical energy infrastructure (e.g., smart grids, SCADA networks) are vulnerable to Model Extraction Attacks (MEAs). In these attacks, adversaries query a victim model to train a functionally equivalent substitute. This substitute serves as an offline testbed for crafting adversarial evasion traffic that bypasses the original IDS.

Existing defenses face significant limitations in this context:

Identity-Bound Detection: Methods like PRADA and FDINet rely on analyzing query patterns per client identity. These fail against Sybil attacks, where adversaries distribute queries across hundreds of identities to evade statistical detection.
Prediction Poisoning: Methods that perturb soft-label outputs (e.g., MODELGUARD) are inapplicable to many IDS deployments that only return hard labels (binary attack/benign decisions).
Data-Free Attacks: Adversaries using data-free extraction methods (e.g., MAZE, DisGUIDE) generate synthetic queries from noise or co-trained generators without access to the original training data, making them difficult to distinguish from legitimate traffic using traditional anomaly detection.

Methodology: FlowGuard
The authors propose FlowGuard, an identity-independent defense mechanism that classifies incoming queries as Out-of-Distribution (OOD) prior to IDS processing. The core premise is that synthetic queries generated for data-free model stealing occupy a lower-dimensional manifold than genuine network traffic, resulting in measurably lower log-likelihoods when evaluated against a density model trained on legitimate data.

The technical workflow involves:

Training a Continuous Normalizing Flow (CNF): A CNF is trained via Flow Matching on the distribution of legitimate network traffic. Unlike traditional flows, Flow Matching trains the model by regressing a neural network onto a conditional velocity field that transports samples from a base Gaussian distribution ( $p_0$ ) to the data distribution ( $p_1$ ). This avoids expensive Jacobian computations during training.
Log-Likelihood Computation: When a query $x_q$ arrives, it is treated as a sample at $t=1$ . The system integrates the learned Ordinary Differential Equation (ODE) backward from $t=1$ to $t=0$ to obtain a latent representation $z_0$ . The log-likelihood $\log p_1(x_q)$ is computed using the instantaneous change of variables formula, which includes the base log-density and an accumulated divergence term (Jacobian correction) along the trajectory.
Decision Thresholding: A threshold $\tau$ is established based on the lower tail of the log-likelihood distribution of a held-out validation set of legitimate queries. If $\log p_1(x_q) < \tau$ , the query is classified as OOD and blocked.

Key Contributions

Identity-Independent Defense: FlowGuard operates solely on query content, requiring no identity metadata, session tracking, or historical query accumulation. This makes it inherently resilient to Sybil attacks.
Flow Matching for OOD Detection: The paper adapts Flow Matching to the specific problem of detecting data-free model stealing, demonstrating that synthetic extraction queries fall into low-density regions of the legitimate data manifold.
Empirical Evaluation: The authors benchmark FlowGuard against state-of-the-art defenses (PRADA, FDINet) using MAZE and DisGUIDE attacks on CIFAR-10. The evaluation covers both single-client and distributed (100-client Sybil) settings.

Results

Single-Client Setting: FlowGuard achieved high detection rates (True Positive Rate, TPR) for both MAZE (0.965) and DisGUIDE (1.000) attacks, with moderate False Positive Rates (FPR ~0.170). It outperformed PRADA in recall for MAZE and matched or exceeded PRADA's performance on DisGUIDE. FDINet showed mixed results, failing to detect MAZE queries effectively (ROC-AUC 0.488).
Distributed (Sybil) Setting:
- PRADA: Detection collapsed completely (TPR 0.000) as queries were distributed across 100 identities, preventing the accumulation of per-client statistics required for its Shapiro-Wilk test.
- FDINet: Showed mixed robustness. While it detected DisGUIDE with high sensitivity, it suffered from a high FPR (0.530) and its performance on MAZE degraded significantly (TPR 0.500).
- FlowGuard: Maintained stable detection performance identical to the single-client setting (TPR 0.965 for MAZE, 1.000 for DisGUIDE). The per-query density evaluation proved unaffected by the distribution of queries across identities.

Significance and Scope
The paper claims that FlowGuard provides a robust solution for securing energy system IDS against distributed, data-free model stealing attacks where identity-based defenses fail. By leveraging the density gap between legitimate traffic and synthetic extraction queries, it offers a defense that does not rely on client identity or soft-label outputs.

The authors explicitly note the following limitations and scope:

The evaluation is currently limited to the CIFAR-10 dataset and a VGG16-BN victim architecture.
The defense is currently effective against data-free attacks (MAZE, DisGUIDE). The paper does not claim universal protection against all extraction families or data-dependent attacks.
Future work is outlined to extend evaluation to realistic IDS datasets (e.g., ERENO IEC 61850), investigate adaptive attackers who optimize against the density model, and potentially combine FlowGuard with velocity-field-based detection (as seen in FlowPure) to defend against the full chain of model stealing followed by adversarial evasion.