FlowPure: Continuous Normalizing Flows for Adversarial Purification

2025-05-19

AI Summary

To address insufficient robustness against adversarial examples, this paper proposes a real-time adversarial purification framework based on Continuous Normalizing Flows (CNFs). We introduce Conditional Flow Matching (CFM) for CNF training—the first such application—enabling differentiable and invertible mapping from adversarial to clean samples. The framework supports two complementary purification modes: attack-prior-guided deterministic purification and Gaussian-perturbation-driven stochastic purification, while simultaneously achieving high-accuracy adversarial detection. Evaluated on CIFAR-10 and CIFAR-100, our method outperforms existing purification approaches across all settings: it maintains 100% clean accuracy even with blind preprocessor configuration, significantly improves robust accuracy under white-box PGD attacks, and detects adversarial samples with ≈100% accuracy. By unifying prior-aware and prior-agnostic purification, our work establishes a novel paradigm for robust inference.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Adversarial Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Security and Privacy: Large-scale security measurements

Abstract

Despite significant advancements in the area, adversarial robustness remains a critical challenge in systems employing machine learning models. The removal of adversarial perturbations at inference time, known as adversarial purification, has emerged as a promising defense strategy. To achieve this, state-of-the-art methods leverage diffusion models that inject Gaussian noise during a forward process to dilute adversarial perturbations, followed by a denoising step to restore clean samples before classification. In this work, we propose FlowPure, a novel purification method based on Continuous Normalizing Flows (CNFs) trained with Conditional Flow Matching (CFM) to learn mappings from adversarial examples to their clean counterparts. Unlike prior diffusion-based approaches that rely on fixed noise processes, FlowPure can leverage specific attack knowledge to improve robustness under known threats, while also supporting a more general stochastic variant trained on Gaussian perturbations for settings where such knowledge is unavailable. Experiments on CIFAR-10 and CIFAR-100 demonstrate that our method outperforms state-of-the-art purification-based defenses in preprocessor-blind and white-box scenarios, and can do so while fully preserving benign accuracy in the former. Moreover, our results show that not only is FlowPure a highly effective purifier but it also holds a strong potential for adversarial detection, identifying preprocessor-blind PGD samples with near-perfect accuracy.

Problem

• Adversarial robustness remains a critical challenge in machine learning systems
• Existing purification methods rely on fixed noise processes, limiting adaptability
• FlowPure improves robustness by learning mappings from adversarial to clean samples

Innovation

• Uses Continuous Normalizing Flows (CNFs)
• Leverages Conditional Flow Matching (CFM)
• Combines specific attack and Gaussian noise knowledge