Despite significant advances in the area, adversarial robustness remains a critical challenge in systems employing machine learning models. The removal of adversarial perturbations at inference time, known as adversarial purification, has emerged as a promising defense strategy. To achieve this, state-of-the-art methods leverage diffusion models that inject Gaussian noise during a forward process to dilute adversarial perturbations, followed by a denoising step to restore clean samples before classification. In this work, we propose FlowPure, a novel purification method based on Continuous Normalizing Flows (CNFs) trained with Conditional Flow Matching (CFM) to learn mappings from adversarial examples to their clean counterparts. Unlike prior diffusion-based approaches that rely on fixed noise processes, FlowPure can leverage specific attack knowledge to improve robustness under known threats, while also supporting a more general stochastic variant trained on Gaussian perturbations for settings where such knowledge is unavailable. Experiments on CIFAR-10 and CIFAR-100 demonstrate that our method outperforms state-of-the-art purification defenses in preprocessor-blind and white-box scenarios, and can do so while fully preserving benign accuracy in the former. Moreover, our results show that not only is FlowPure a highly effective purifier but it also holds strong potential for adversarial detection, identifying preprocessor-blind PGD samples with near-perfect accuracy. Our code is publicly available at https://github.com/DistriNet/FlowPure.

翻译：尽管该领域取得了显著进展，但采用机器学习模型的系统中的对抗鲁棒性仍是一项关键挑战。在推理阶段移除对抗扰动的方法——即对抗净化——已成为一种有前景的防御策略。为实现这一目标，最先进的方法利用扩散模型：在前向过程中注入高斯噪声以稀释对抗扰动，随后通过去噪步骤恢复干净样本再进行分类。本文提出FlowPure，一种基于连续归一化流的新型净化方法。该方法通过条件流匹配训练，学习从对抗样本到干净样本的映射。与依赖固定噪声过程的传统扩散方法不同，FlowPure能利用特定攻击知识提升已知威胁下的鲁棒性，同时支持基于高斯扰动训练的通用随机变体，适用于未知攻击场景。在CIFAR-10和CIFAR-100上的实验表明，我们的方法在预处理器不可知和白盒攻击场景下均优于最先进的净化防御方法，且在前者中能完全保留良性样本准确率。此外，结果显示FlowPure不仅是高效的净化器，还具备强大的对抗检测潜力，能以近乎完美的准确率识别预处理器不可知的PGD样本。我们的代码已开源在https://github.com/DistriNet/FlowPure。