---
title: "利用梯度引导流匹配实现人脸识别模型反演攻击"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2608.16791v1"
permalink: "https://feed.astralor.com/items/itm_058905ac5f1e9c065a8e8f33"
published: "2026-08-17T16:47:09.000Z"
score: 76
channel: "ai"
tags: ["CelebA","Flow Matching","SFMI","人脸识别","模型反演攻击"]
---

# 利用梯度引导流匹配实现人脸识别模型反演攻击

## AI 点评

> 这篇论文值得关注，因为它把生成式AI里火热的Flow Matching从‘生成图片’跨界到‘反向攻击人脸识别’，思路非常巧妙。对研究模型安全、隐私保护的同学来说，这是理解白盒攻击上限的一个重要参考。

## 速览

模型反演攻击（MIA）旨在从人脸识别模型中重建目标身份的训练样本，暴露严重安全漏洞。现有方法依赖间接或高随机性引导，难以稳定优化生成轨迹。本文提出SFMI，一种两阶段白盒模型反演方法：第一阶段预训练通用无条件流匹配模型，将人脸流形编码为强先验；第二阶段提出渐进式引导调度器（PGS），在采样时注入随时间变化的目标特定梯度，通过反向传播中间生成状态获得梯度，自适应引导生成流从随机噪声移向目标类别高密度区域。在CelebA数据集上，针对ArcFace目标，SFMI实现ACC 0.9248、FID 22.61、LPIPS 0.3874，并在多个目标模型上达到先进的攻击成功率与视觉保真度。

## 关键点

- 提出SFMI，将模型反演重构成轨迹引导任务，分为流匹配先验学习和渐进式引导调度两阶段。
- 渐进式引导调度器通过中间生成状态反向传播获取目标梯度，实现稳定且自适应的攻击引导。
- 在CelebA数据集上，针对ArcFace目标模型，ACC达0.9248，FID为22.61，LPIPS为0.3874。
- 在多个白盒目标模型上展示了具有竞争力的攻击成功率和视觉保真度。

## 全文

Model Inversion Attacks (MIAs) aim to reconstruct representative training samples of target identities from face recognition models, exposing critical security vulnerabilities. Existing methods typically rely on indirect guidance or highly stochastic guidance, making it difficult to stably optimize generation trajectories toward target facial images. In this paper, we propose Steering Flow Model Inversion (SFMI), a novel two-stage white-box model inversion method that reformulates inversion as a trajectory-steering task. Specifically, Step I, Learning a Generic Flow Matching Prior, pre-trains a generic unconditional Flow Matching model to encode the manifold of human faces as a robust prior. Step II, Attacking with Progressive Guidance Scheduler (PGS), injects time-dependent target-specific gradients during sampling. By backpropagating through the target model to obtain gradients from intermediate generated states, PGS progressively injects adaptive guidance signals into the vector field. This process effectively steers the current generative flow from random noise toward the high-density regions of the target class. Under an identity-disjoint cross-evaluation setting using the CelebA dataset, SFMI achieves an ACC of 0.9248, an FID of 22.61, and an LPIPS of 0.3874 on the ArcFace target. Extensive experiments on multiple target models demonstrate that SFMI achieves competitive state-of-the-art performance in attack success and visual fidelity under the evaluated white-box protocol.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_058905ac5f1e9c065a8e8f33