FlowPure: Continuous Normalizing Flows for Adversarial Purification

TL;DR

FlowPure is proposed, a novel purification method based on Continuous Normalizing Flows trained with Conditional Flow Matching to learn mappings from adversarial examples to their clean counterparts that outperforms state-of-the-art purification-based defenses in preprocessor-blind and white-box scenarios, and can do so while fully preserving benign accuracy in the former.

Abstract

Despite significant advancements in the area, adversarial robustness remains a critical challenge in systems employing machine learning models. The removal of adversarial perturbations at inference time, known as adversarial purification, has emerged as a promising defense strategy. To achieve this, state-of-the-art methods leverage diffusion models that inject Gaussian noise during a forward process to dilute adversarial perturbations, followed by a denoising step to restore clean samples before classification. In this work, we propose FlowPure, a novel purification method based on Continuous Normalizing Flows (CNFs) trained with Conditional Flow Matching (CFM) to learn mappings from adversarial examples to their clean counterparts. Unlike prior diffusion-based approaches that rely on fixed noise processes, FlowPure can leverage specific attack knowledge to improve robustness under known threats, while also supporting a more general stochastic variant trained on Gaussian perturbations for settings where such knowledge is unavailable. Experiments on CIFAR-10 and CIFAR-100 demonstrate that our method outperforms state-of-the-art purification-based defenses in preprocessor-blind and white-box scenarios, and can do so while fully preserving benign accuracy in the former. Moreover, our results show that not only is FlowPure a highly effective purifier but it also holds a strong potential for adversarial detection, identifying preprocessor-blind PGD samples with near-perfect accuracy.

Figures (5)

• Figure 1: Left: Opposed to traditional diffusion-based purification methods that require adding Gaussian noise to samples, FlowPure can learn a direct transformation between arbitrary distributions. Right: Training and purification pipelines of FlowPure. The model $v_\theta(t,x_t)$ is trained to approximate the velocity field $u_t(x_{adv},x_{clean})$ using the loss $\mathcal{L}_{CFM}$. The purification loop illustrates the update rule, which should be applied iteratively, moving the sample towards the clean distribution.
• Figure 2: Standard/Robust accuracy trade-off under DH wang2024diffhammer (10 resubmissions), of $FlowPure^{Gauss}$ and DiffPure diffpure, for different levels of noise injection (noise ranges are $\sigma \in [0.15,0.35]$ for the former, and $t^*\in [50,180]$ for the latter). Higher values on both axes are better, with increases in standard accuracy correlated with lower noise levels. Note that the y-axes differ between the plots.
• Figure 3: Distribution of detection scores for PGD and CW attacks. PGD attacks can be detected with near-perfect accuracy by FlowPure in both CIFAR-10 and CIFAR-100.
• Figure 4: Detection performance of FlowPure and BEYOND in the preprocessor-blind setting.
• Figure 5: PGD adversarial examples in CIFAR-10 purified with several methods. $FlowPure^{PGD}$ produces the clearest reconstructions, often removing minor artifacts present in the original image.