---
title: "Steering the Flow: Inverting Face Recognition Models via Gradient-Guided Flow Matching"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2608.16791v1"
permalink: "https://feed.astralor.com/items/itm_058905ac5f1e9c065a8e8f33"
published: "2026-08-17T16:47:09.000Z"
score: 76
channel: "ai"
tags: ["CelebA","Flow Matching","SFMI","Face Recognition","Model Inversion Attack"]
---

# Steering the Flow: Inverting Face Recognition Models via Gradient-Guided Flow Matching

## AI commentary

> This paper is worth attention because it cleverly extends the hot Flow Matching from 'generating images' to 'inverting face recognition', offering a fresh angle for model security research. For those studying AI safety and privacy, it provides a key reference for understanding the upper bound of white-box attacks.

## At a glance

Model Inversion Attacks (MIAs) aim to reconstruct representative training samples of target identities from face recognition models, exposing critical security vulnerabilities. Existing methods rely on indirect or highly stochastic guidance, making it difficult to stably optimize generation trajectories. This paper proposes SFMI, a two-stage white-box inversion method: Stage I pre-trains a generic unconditional Flow Matching model to encode the human face manifold as a robust prior; Stage II introduces a Progressive Guidance Scheduler (PGS) that injects time-dependent target-specific gradients during sampling. By backpropagating through the target model to obtain gradients from intermediate generated states, PGS adaptively steers the generative flow from random noise toward high-density regions of the target class. On CelebA with ArcFace target, SFMI achieves ACC 0.9248, FID 22.61, LPIPS 0.3874, and competitive state-of-the-art performance across multiple target models in white-box settings.

## Key points

- Proposes SFMI, reformulating model inversion as a trajectory-steering task with two stages: flow matching prior learning and progressive guidance scheduling.
- The Progressive Guidance Scheduler obtains target gradients via backpropagation from intermediate generated states, enabling stable and adaptive attack guidance.
- On CelebA with ArcFace target, SFMI achieves ACC of 0.9248, FID of 22.61, and LPIPS of 0.3874.
- Demonstrates competitive attack success and visual fidelity across multiple white-box target models.

## Full text

Model Inversion Attacks (MIAs) aim to reconstruct representative training samples of target identities from face recognition models, exposing critical security vulnerabilities. Existing methods typically rely on indirect guidance or highly stochastic guidance, making it difficult to stably optimize generation trajectories toward target facial images. In this paper, we propose Steering Flow Model Inversion (SFMI), a novel two-stage white-box model inversion method that reformulates inversion as a trajectory-steering task. Specifically, Step I, Learning a Generic Flow Matching Prior, pre-trains a generic unconditional Flow Matching model to encode the manifold of human faces as a robust prior. Step II, Attacking with Progressive Guidance Scheduler (PGS), injects time-dependent target-specific gradients during sampling. By backpropagating through the target model to obtain gradients from intermediate generated states, PGS progressively injects adaptive guidance signals into the vector field. This process effectively steers the current generative flow from random noise toward the high-density regions of the target class. Under an identity-disjoint cross-evaluation setting using the CelebA dataset, SFMI achieves an ACC of 0.9248, an FID of 22.61, and an LPIPS of 0.3874 on the ArcFace target. Extensive experiments on multiple target models demonstrate that SFMI achieves competitive state-of-the-art performance in attack success and visual fidelity under the evaluated white-box protocol.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_058905ac5f1e9c065a8e8f33